From David1 at suescornerweb.com  Sat Jan  1 03:29:18 2005
From: David1 at suescornerweb.com (David 1)
Date: Sat Jan  1 03:30:12 2005
Subject: [SC-Help] I bounced ????
Message-ID: <cr5n1c$qtr$1@news.spamcop.net>

Is there a way I could see that bounce report or someone tell me how I 
bounced I don't have a quota not that it maters because I usually 
download my mail a min of every 5 hours when not on line & every 10 min. 
when I am on line & since I usually log over 20K min a month I'm on line 
quite a bit. I'm just curious how I bounced not upset just don't see it 
being because of quota <G>
-- 

David 1
bad addy
spamtrap@suescornerweb.com
From nobody at spamcop.net  Sat Jan  1 11:27:42 2005
From: nobody at spamcop.net (Ellen)
Date: Sat Jan  1 11:30:04 2005
Subject: [SC-Help] Re: I bounced ????
References: <cr5n1c$qtr$1@news.spamcop.net>
Message-ID: <cr6j4g$9jd$1@news.spamcop.net>



"David 1" <David1@suescornerweb.com> wrote in message
news:cr5n1c$qtr$1@news.spamcop.net...
> Is there a way I could see that bounce report or someone tell me how I
> bounced I don't have a quota not that it maters because I usually
> download my mail a min of every 5 hours when not on line & every 10 min.
> when I am on line & since I usually log over 20K min a month I'm on line
> quite a bit. I'm just curious how I bounced not upset just don't see it
> being because of quota <G>
> -- 
>
> David 1
> bad addy
> spamtrap@suescornerweb.com

Write to service@admin.spamcop.net and include your registered SpamCop email
address.

Ellen


From David1 at suescornerweb.com  Sat Jan  1 12:26:43 2005
From: David1 at suescornerweb.com (David 1)
Date: Sat Jan  1 12:30:03 2005
Subject: [SC-Help] Re: I bounced ????
In-Reply-To: <cr6j4g$9jd$1@news.spamcop.net>
References: <cr5n1c$qtr$1@news.spamcop.net> <cr6j4g$9jd$1@news.spamcop.net>
Message-ID: <cr6mfm$b7o$1@news.spamcop.net>

Ellen wrote:
> "David 1" <David1@suescornerweb.com> wrote in message
> news:cr5n1c$qtr$1@news.spamcop.net...
> 
>>Is there a way I could see that bounce report or someone tell me how I
>>bounced I don't have a quota not that it maters because I usually
>>download my mail a min of every 5 hours when not on line & every 10 min.
>>when I am on line & since I usually log over 20K min a month I'm on line
>>quite a bit. I'm just curious how I bounced not upset just don't see it
>>being because of quota <G>
>>-- 
>>
>>David 1
>>bad addy
>>spamtrap@suescornerweb.com
> 
> 
> Write to service@admin.spamcop.net and include your registered SpamCop email
> address.
> 
> Ellen
> 
> 

I did & I thank ya!

-- 

David 1
bad addy
spamtrap@suescornerweb.com
From autoreply at funchords.com  Sat Jan  1 11:24:15 2005
From: autoreply at funchords.com (Robb Topolski)
Date: Sat Jan  1 14:25:02 2005
Subject: [SC-Help] 
	False Spamcop Positives on Yahoogroups Messages (66.94.237.42)
Message-ID: <cr6td6$fsc$1@news.spamcop.net>

SC Deputies or Power Users:

The following message was identified by the bl.spamcop.net ... I'm 
wondering if it was tagged by mere volume (which should be inappropriate), 
or if someone was indeed abusing this IP.

I thought there used to be a way of looking at some rudimentary evidence 
file, but either it's gone or hard to find.

Thanks for any pointers.

Example Headers and Body of the False Postive Snipped below:

Received: from n8a.bulk.scd.yahoo.com ([66.94.237.42])
          by sccrmxc24.comcast.net (sccrmxc24) with SMTP
          id <20__________________33de>; Sat, 1 Jan 2005 17:12:19 +0000
X-Originating-IP: [66.94.237.42]
Received: from [66.218.69.5] by n8.bulk.scd.yahoo.com with NNFMP; 01 Jan 
2005 17:12:18 -0000
Received: from [66.218.66.30] by mailer5.bulk.scd.yahoo.com with NNFMP; 01 
Jan 2005 17:12:18 -0000
X-Yahoo-Newman-Property: groups-mod
X-Sender: notify@yahoogroups.com
X-Apparently-To: mygroup-owner@yahoogroups.com
Received: (qmail 68567 invoked by uid 7800); 1 Jan 2005 17:12:18 -0000
Date: 1 Jan 2005 17:12:18 -0000
Message-ID: <110_____________.m24@yahoogroups.com>
MIME-Version: 1.0
From: Yahoo! Groups Notification 
<mygroup-accept-A80_cP_________YpA@yahoogroups.com>
Reply-To: mygroup-accept-A8_____________pA@yahoogroups.com
To: mygroup-owner@yahoogroups.com
Subject: MODERATE -- <X> posted to pdx-poker
Content-Type: multipart/mixed;
  boundary="-----003___________________9107"
X-eGroups-Moderators: pdx-poker
X-RBL-Warning: bl.spamcop.net returns 127.0.0.2 (SPAMCOP) for 66.94.237.42

Hello,

A message has been sent to the mygroup group from

  <X>

The message summary:
--------------------
FROM:

[...remainder snipped...] 


From nobody at devnull.spamcop.net  Sat Jan  1 13:30:07 2005
From: nobody at devnull.spamcop.net (WazoO)
Date: Sat Jan  1 14:35:03 2005
Subject: [SC-Help] 
	Re: False Spamcop Positives on Yahoogroups Messages (66.94.237.42)
References: <cr6td6$fsc$1@news.spamcop.net>
Message-ID: <cr6to0$g1k$1@news.spamcop.net>

"Robb Topolski" <autoreply@funchords.com> wrote in message
news:cr6td6$fsc$1@news.spamcop.net...
> SC Deputies or Power Users:
>
> The following message was identified by the bl.spamcop.net ... I'm
> wondering if it was tagged by mere volume (which should be inappropriate),
> or if someone was indeed abusing this IP.
>
> I thought there used to be a way of looking at some rudimentary evidence
> file, but either it's gone or hard to find.
>
> Thanks for any pointers.

Not a Deputy, only the owner of a free-reporting account ...
However, noting the simultaneous posting of a Yahoo
Groups blocking action here and in the web-based Forum ..
Same answer provided here as over there ... please check
the web-based version of the FAQ, look for an entry with
the title of "Yahoo Groups Mail Blocked?"
http://forum.spamcop.net/forums/


From autoreply at funchords.com  Sat Jan  1 11:48:44 2005
From: autoreply at funchords.com (Robb Topolski)
Date: Sat Jan  1 14:50:03 2005
Subject: [SC-Help] 
	Re: False Spamcop Positives on Yahoogroups Messages (66.94.237.42)
References: <cr6td6$fsc$1@news.spamcop.net> <cr6to0$g1k$1@news.spamcop.net>
Message-ID: <cr6uqv$gnq$1@news.spamcop.net>


"WazoO" <nobody@devnull.spamcop.net> wrote in message 
news:cr6to0$g1k$1@news.spamcop.net...
> Not a Deputy, only the owner of a free-reporting account ...
> However, noting the simultaneous posting of a Yahoo
> Groups blocking action here and in the web-based Forum ..
> Same answer provided here as over there ... please check
> the web-based version of the FAQ, look for an entry with
> the title of "Yahoo Groups Mail Blocked?"
> http://forum.spamcop.net/forums/

Thanks!   I didn't even know about that forum!

I read that FAQ entry and it's as clear as mud.

I still would like someone to take a peek and see if this is really abuse. 


From MikeE at ster.invalid  Sat Jan  1 11:50:08 2005
From: MikeE at ster.invalid (Mike Easter)
Date: Sat Jan  1 14:50:04 2005
Subject: [SC-Help] 
	Re: False Spamcop Positives on Yahoogroups Messages (66.94.237.42)
References: <cr6td6$fsc$1@news.spamcop.net> <cr6to0$g1k$1@news.spamcop.net>
Message-ID: <cr6uri$go2$1@news.spamcop.net>

WazoO wrote:
> Not a Deputy, only the owner of a free-reporting account ...
> However, noting the simultaneous posting of a Yahoo
> Groups blocking action here and in the web-based Forum ..
> Same answer provided here as over there ... please check
> the web-based version of the FAQ, look for an entry with
> the title of "Yahoo Groups Mail Blocked?"
> http://forum.spamcop.net/forums/

The only place 'Yahoo Groups Mail Blocked' appears is in the thread
http://forum.spamcop.net/forums/index.php?showtopic=3348&st=0&p=22176&#entry22176
 Yahoo Groups Blacklisted

but it doesn't really say much helpful.

The SC bl currently has 66.94.237.42 listed, which is also listed in
spambag's backscatter2.

In addition, the scbl also shows all this:

Other hosts in this "neighborhood" with spam reports
66.94.237.16 66.94.237.20 66.94.237.24 66.94.237.28
66.94.237.32 66.94.237.35 66.94.237.36 66.94.237.37
66.94.237.38 66.94.237.39 66.94.237.40 66.94.237.41
66.94.237.43 66.94.237.44 66.94.237.45 66.94.237.46
66.94.237.47 66.94.237.48 66.94.237.49 66.94.237.50
66.94.237.51

All of those but one are currently listed, altho' some have short times
left, so some others may age off soon.

-- 
Mike Easter
kibitzer, not SC admin

From nobody at devnull.spamcop.net  Sat Jan  1 15:22:02 2005
From: nobody at devnull.spamcop.net (WazoO)
Date: Sat Jan  1 16:25:04 2005
Subject: [SC-Help] 
	Re: False Spamcop Positives on Yahoogroups Messages (66.94.237.42)
References: <cr6td6$fsc$1@news.spamcop.net> <cr6to0$g1k$1@news.spamcop.net>
	<cr6uri$go2$1@news.spamcop.net>
Message-ID: <cr749q$jto$1@news.spamcop.net>

"Mike Easter" <MikeE@ster.invalid> wrote in message
news:cr6uri$go2$1@news.spamcop.net...
> WazoO wrote:
> > Not a Deputy, only the owner of a free-reporting account ...
> > However, noting the simultaneous posting of a Yahoo
> > Groups blocking action here and in the web-based Forum ..
> > Same answer provided here as over there ... please check
> > the web-based version of the FAQ, look for an entry with
> > the title of "Yahoo Groups Mail Blocked?"
> > http://forum.spamcop.net/forums/
>
> The only place 'Yahoo Groups Mail Blocked' appears is in the thread
>
http://forum.spamcop.net/forums/index.php?showtopic=3348&st=0&p=22176&#entry22176
>  Yahoo Groups Blacklisted
>
> but it doesn't really say much helpful.

  I was pointing to an entry in the FAQ list over there ... which
actually leads you into another "discussion" at
http://forum.spamcop.net/forums/index.php?showtopic=2472&st=0&p=15986&#entry15986
somehow you snagged the entry to a disussion started today ..??
(noting that some Forum sections were recently created, a
bunch of postings moved ..??)
)
> The SC bl currently has 66.94.237.42 listed, which is also listed in
> spambag's backscatter2.
>
> In addition, the scbl also shows all this:
>
> Other hosts in this "neighborhood" with spam reports
> 66.94.237.16 66.94.237.20 66.94.237.24 66.94.237.28
> 66.94.237.32 66.94.237.35 66.94.237.36 66.94.237.37
> 66.94.237.38 66.94.237.39 66.94.237.40 66.94.237.41
> 66.94.237.43 66.94.237.44 66.94.237.45 66.94.237.46
> 66.94.237.47 66.94.237.48 66.94.237.49 66.94.237.50
> 66.94.237.51
>
> All of those but one are currently listed, altho' some have short times
> left, so some others may age off soon.

Thanks for the research .. have been busy here with a bit of
an ice storm thing, a troll gone wild "over there" ... on and on <g>


From nobody at spamcop.net  Sun Jan  2 00:02:17 2005
From: nobody at spamcop.net (RW)
Date: Sun Jan  2 01:05:06 2005
Subject: [SC-Help] 
	Re: False Spamcop Positives on Yahoogroups Messages (66.94.237.42)
References: <cr6td6$fsc$1@news.spamcop.net> <cr6to0$g1k$1@news.spamcop.net>
	<cr6uqv$gnq$1@news.spamcop.net>
Message-ID: <cr82p6$7d9$1@news.spamcop.net>

"Robb Topolski" <autoreply@funchords.com> wrote in message 
news:cr6uqv$gnq$1@news.spamcop.net...
>
> I still would like someone to take a peek and see if this is really abuse.

I've been looking at the Yahoo IPs all day and yes, all the listings are 
legit due to spam, mostly to spamtraps.  Yahoo doesn't do its users any 
favours by allowing lists to be imported and subscriptions to be completed 
without confirmations.

Usually the traffic numbers are high enough to limit the listings, but I 
think general traffic is probably lower because of the holiday period. 
Spammers haven't slowed down though, so the spam ratios are higher than 
normal.

Richard 


From nobody at spamcop.net  Sun Jan  2 01:05:53 2005
From: nobody at spamcop.net (Miss Betsy)
Date: Sun Jan  2 01:05:08 2005
Subject: [SC-Help] 
	Re: False Spamcop Positives on Yahoogroups Messages (66.94.237.42)
References: <cr6td6$fsc$1@news.spamcop.net> <cr6to0$g1k$1@news.spamcop.net>
	<cr6uqv$gnq$1@news.spamcop.net>
Message-ID: <cr82qj$7er$1@news.spamcop.net>

<snip>
> I read that FAQ entry and it's as clear as mud.

I don't understand about yahoo groups and why spammers can abuse
them so easily, but it happens apparently.

There is another thread in the main spamcop group about why some
'popular' mailing list has gotten on the spamcop bl.  From what I
can tell the reason is that this 'big name' and popular mailing
list is totally ignoring industry best practices.  And from what I
can tell, yahoo does also.

Spam is spam - the content doesn't matter; it is the method in
which it is delivered - as a confirmed subscription or just because
the merchant thinks no one will complain because he has such a
great product, everyone will like to get his mailings.

yahoo thinks it can get away with sloppy practices because it
offers a popular service and thereby opens up the whole internet
for every wannabe great service provider aka spam.

Miss Betsy


From mrichter at cpl.net  Sat Jan  1 23:40:05 2005
From: mrichter at cpl.net (Mike Richter)
Date: Sun Jan  2 02:40:03 2005
Subject: [SC-Help] 
	Re: False Spamcop Positives on Yahoogroups Messages (66.94.237.42)
In-Reply-To: <cr82qj$7er$1@news.spamcop.net>
References: <cr6td6$fsc$1@news.spamcop.net> <cr6to0$g1k$1@news.spamcop.net>
	<cr6uqv$gnq$1@news.spamcop.net> <cr82qj$7er$1@news.spamcop.net>
Message-ID: <cr88fr$b3r$1@news.spamcop.net>

Miss Betsy wrote:

> <snip>
> 
>>I read that FAQ entry and it's as clear as mud.
> 
> 
> I don't understand about yahoo groups and why spammers can abuse
> them so easily, but it happens apparently.

It's easy enough. Yahoo! allows open groups, meaning that a spammer can 
sign up and send one or more posts to all subscribers before being 
stopped by the listowner or a moderator. In addition, a spammer can open 
a group and subscribe members without their confirmation - though Yahoo! 
has made that undesirable (by spammer standards) by limiting the number 
who can be added at once.

I 'own' some Yahoo! groups. All are closed (subscription by invitation 
only) and none permits subscription without confirmation.

Mike
-- 
mrichter@cpl.net
http://www.mrichter.com/

From MikeE at ster.invalid  Sun Jan  2 07:37:39 2005
From: MikeE at ster.invalid (Mike Easter)
Date: Sun Jan  2 10:40:05 2005
Subject: [SC-Help] 
	Re: False Spamcop Positives on Yahoogroups Messages (66.94.237.42)
References: <cr6td6$fsc$1@news.spamcop.net> <cr6to0$g1k$1@news.spamcop.net>
	<cr6uqv$gnq$1@news.spamcop.net> <cr82qj$7er$1@news.spamcop.net>
	<cr88fr$b3r$1@news.spamcop.net>
Message-ID: <cr94e2$rh6$1@news.spamcop.net>

Mike Richter wrote:
> It's easy enough. Yahoo! allows open groups,

> I 'own' some Yahoo! groups. All are closed (subscription by invitation
> only) and none permits subscription without confirmation.

Yahoo should segregate its regular mail and closed groups mail servers
from its open groups mailservers so that the listed yahoo servers won't
affect its regular mail and closed groups mail out -- that is, if they
believe that having an open group system is worth keeping if burdened by
frequent listings of the mailservers.

-- 
Mike Easter
kibitzer, not SC admin

From David1 at suescornerweb.com  Sun Jan  2 11:14:35 2005
From: David1 at suescornerweb.com (David 1)
Date: Sun Jan  2 11:15:02 2005
Subject: [SC-Help] 
	Re: False Spamcop Positives on Yahoogroups Messages (66.94.237.42)
In-Reply-To: <cr94e2$rh6$1@news.spamcop.net>
References: <cr6td6$fsc$1@news.spamcop.net> <cr6to0$g1k$1@news.spamcop.net>
	<cr6uqv$gnq$1@news.spamcop.net> <cr82qj$7er$1@news.spamcop.net>
	<cr88fr$b3r$1@news.spamcop.net> <cr94e2$rh6$1@news.spamcop.net>
Message-ID: <cr96l6$svt$1@news.spamcop.net>

Mike Easter wrote:
> Mike Richter wrote:
> 
>>It's easy enough. Yahoo! allows open groups,
> 
> 
>>I 'own' some Yahoo! groups. All are closed (subscription by invitation
>>only) and none permits subscription without confirmation.
> 
> 
> Yahoo should segregate its regular mail and closed groups mail servers
> from its open groups mailservers so that the listed yahoo servers won't
> affect its regular mail and closed groups mail out -- that is, if they
> believe that having an open group system is worth keeping if burdened by
> frequent listings of the mailservers.
> 

Well there is one function that I made the mistake of using untill an 
upset person told me about it in no other term <G> you do have the 
option to "direct add" a person but there is a big notece that missuse 
will lead to loss of your account/group. Also as a user in you user 
settings you can set yourself wether you're allowed to be direct added 
if you check no then suppo9edly an owner/moderator can't direct add you.

-- 

David 1
bad addy
spamtrap@suescornerweb.com
From nobody at spamcop.net  Sun Jan  2 12:34:11 2005
From: nobody at spamcop.net (Miss Betsy)
Date: Sun Jan  2 12:35:02 2005
Subject: [SC-Help] 
	Re: False Spamcop Positives on Yahoogroups Messages (66.94.237.42)
References: <cr6td6$fsc$1@news.spamcop.net> <cr6to0$g1k$1@news.spamcop.net>
	<cr6uqv$gnq$1@news.spamcop.net> <cr82qj$7er$1@news.spamcop.net>
	<cr88fr$b3r$1@news.spamcop.net> <cr94e2$rh6$1@news.spamcop.net>
Message-ID: <cr9b56$via$1@news.spamcop.net>


"Mike Easter" <MikeE@ster.invalid> wrote in message
news:cr94e2$rh6$1@news.spamcop.net...
> Mike Richter wrote:
> > It's easy enough. Yahoo! allows open groups,
>
> > I 'own' some Yahoo! groups. All are closed (subscription by
invitation
> > only) and none permits subscription without confirmation.
>
> Yahoo should segregate its regular mail and closed groups mail
servers
> from its open groups mailservers so that the listed yahoo servers
won't
> affect its regular mail and closed groups mail out -- that is, if
they
> believe that having an open group system is worth keeping if
burdened by
> frequent listings of the mailservers.

Seems simple enough to me.

Miss Betsy


From wb8tyw at qsl.network  Sun Jan  2 16:16:06 2005
From: wb8tyw at qsl.network (John E. Malmberg)
Date: Sun Jan  2 16:20:03 2005
Subject: [SC-Help] 
	Re: False Spamcop Positives on Yahoogroups Messages (66.94.237.42)
In-Reply-To: <cr96l6$svt$1@news.spamcop.net>
References: <cr6td6$fsc$1@news.spamcop.net> <cr6to0$g1k$1@news.spamcop.net>
	<cr6uqv$gnq$1@news.spamcop.net> <cr82qj$7er$1@news.spamcop.net>
	<cr88fr$b3r$1@news.spamcop.net> <cr94e2$rh6$1@news.spamcop.net>
	<cr96l6$svt$1@news.spamcop.net>
Message-ID: <cr9oan$7pq$1@news.spamcop.net>

David 1 wrote:
> 
> Well there is one function that I made the mistake of using untill an 
> upset person told me about it in no other term <G> you do have the 
> option to "direct add" a person but there is a big notece that missuse 
> will lead to loss of your account/group.

And since it appears that the spammers have come up with a program that 
allows them to create an unlimited number of throw away groups and 
e-mail accounts, why should the spammer care?

The spammers that are using Yahoo Groups are assuming that their account 
or group will be shutdown after the spam run.

 From analyzing the output of when a Yahoo Group that I was a member of 
was getting spammed because joining did not require a human approval, it 
was very obvious that the spammer was using a program to create 
throw-away Yahoo accounts.

A google search of news.admin.net-abuse.email shows 15 samples from the 
I.P. address in the title.

Many of them come from a regular poster in these newsgroups, and IIRC, 
that poster has stated that they are not a member of any Yahoo Group.

These basically confirm what the deputy has stated, Yahoo is allowing 
spammers to use these servers.

One spammer seems to have been able to operate for several months.

-John
wb8tyw@qsl.network
Personal Opinion Only



From nobody at spamcop.net  Sun Jan  2 20:58:18 2005
From: nobody at spamcop.net (RW)
Date: Sun Jan  2 22:00:04 2005
Subject: [SC-Help] 
	Re: False Spamcop Positives on Yahoogroups Messages (66.94.237.42)
References: <cr6td6$fsc$1@news.spamcop.net> <cr6to0$g1k$1@news.spamcop.net>
	<cr6uqv$gnq$1@news.spamcop.net> <cr82qj$7er$1@news.spamcop.net>
	<cr88fr$b3r$1@news.spamcop.net> <cr94e2$rh6$1@news.spamcop.net>
	<cr96l6$svt$1@news.spamcop.net>
Message-ID: <cracc5$kmq$1@news.spamcop.net>

"David 1" <David1@suescornerweb.com> wrote in message 
news:cr96l6$svt$1@news.spamcop.net...

> will lead to loss of your account/group. Also as a user in you user 
> settings you can set yourself wether you're allowed to be direct added if 
> you check no then suppo9edly an owner/moderator can't direct add you.

but that only applies to yahoo addresses

Richard 


From David1 at suescornerweb.com  Mon Jan  3 00:24:46 2005
From: David1 at suescornerweb.com (David 1)
Date: Mon Jan  3 00:25:07 2005
Subject: [SC-Help] 
	Re: False Spamcop Positives on Yahoogroups Messages (66.94.237.42)
In-Reply-To: <cracc5$kmq$1@news.spamcop.net>
References: <cr6td6$fsc$1@news.spamcop.net> <cr6to0$g1k$1@news.spamcop.net>
	<cr6uqv$gnq$1@news.spamcop.net> <cr82qj$7er$1@news.spamcop.net>
	<cr88fr$b3r$1@news.spamcop.net> <cr94e2$rh6$1@news.spamcop.net>
	<cr96l6$svt$1@news.spamcop.net> <cracc5$kmq$1@news.spamcop.net>
Message-ID: <craktm$pbs$3@news.spamcop.net>

RW wrote:
> "David 1" <David1@suescornerweb.com> wrote in message 
> news:cr96l6$svt$1@news.spamcop.net...
> 
> 
>>will lead to loss of your account/group. Also as a user in you user 
>>settings you can set yourself wether you're allowed to be direct added if 
>>you check no then suppo9edly an owner/moderator can't direct add you.
> 
> 
> but that only applies to yahoo addresses
> 
> Richard 
> 
> 

I'm not positive but I belive it's any addy in their profile

-- 

David 1
bad addy
spamtrap@suescornerweb.com
From nobody at spamcop.net  Sun Jan  2 23:41:20 2005
From: nobody at spamcop.net (RW)
Date: Mon Jan  3 00:45:03 2005
Subject: [SC-Help] 
	Re: False Spamcop Positives on Yahoogroups Messages (66.94.237.42)
References: <cr6td6$fsc$1@news.spamcop.net> <cr6to0$g1k$1@news.spamcop.net>
	<cr6uqv$gnq$1@news.spamcop.net> <cr82qj$7er$1@news.spamcop.net>
	<cr88fr$b3r$1@news.spamcop.net> <cr94e2$rh6$1@news.spamcop.net>
	<cr96l6$svt$1@news.spamcop.net> <cracc5$kmq$1@news.spamcop.net>
	<craktm$pbs$3@news.spamcop.net>
Message-ID: <cralts$qoo$1@news.spamcop.net>

"David 1" <David1@suescornerweb.com> wrote in message 
news:craktm$pbs$3@news.spamcop.net...
> RW wrote:
>> "David 1" <David1@suescornerweb.com> wrote in message 
>> news:cr96l6$svt$1@news.spamcop.net...
>>
>>>will lead to loss of your account/group. Also as a user in you user 
>>>settings you can set yourself wether you're allowed to be direct added if 
>>>you check no then suppo9edly an owner/moderator can't direct add you.
>>
>> but that only applies to yahoo addresses
>
> I'm not positive but I belive it's any addy in their profile

But again, only if you are a member/user of Yahoo.  I can't prevent my 
address from being added to a Yahoo group.  And yes, I have had my address 
forge subscribed to Yahoo groups.

Richard 


From David1 at suescornerweb.com  Mon Jan  3 00:58:33 2005
From: David1 at suescornerweb.com (David 1)
Date: Mon Jan  3 01:00:02 2005
Subject: [SC-Help] 
	Re: False Spamcop Positives on Yahoogroups Messages (66.94.237.42)
In-Reply-To: <cralts$qoo$1@news.spamcop.net>
References: <cr6td6$fsc$1@news.spamcop.net> <cr6to0$g1k$1@news.spamcop.net>
	<cr6uqv$gnq$1@news.spamcop.net> <cr82qj$7er$1@news.spamcop.net>
	<cr88fr$b3r$1@news.spamcop.net> <cr94e2$rh6$1@news.spamcop.net>
	<cr96l6$svt$1@news.spamcop.net> <cracc5$kmq$1@news.spamcop.net>
	<craktm$pbs$3@news.spamcop.net> <cralts$qoo$1@news.spamcop.net>
Message-ID: <cramt2$rb2$1@news.spamcop.net>

RW wrote:
> "David 1" <David1@suescornerweb.com> wrote in message 
> news:craktm$pbs$3@news.spamcop.net...
> 
>>RW wrote:
>>
>>>"David 1" <David1@suescornerweb.com> wrote in message 
>>>news:cr96l6$svt$1@news.spamcop.net...
>>>
>>>
>>>>will lead to loss of your account/group. Also as a user in you user 
>>>>settings you can set yourself wether you're allowed to be direct added if 
>>>>you check no then suppo9edly an owner/moderator can't direct add you.
>>>
>>>but that only applies to yahoo addresses
>>
>>I'm not positive but I belive it's any addy in their profile
> 
> 
> But again, only if you are a member/user of Yahoo.  I can't prevent my 
> address from being added to a Yahoo group.  And yes, I have had my address 
> forge subscribed to Yahoo groups.
> 
> Richard 
> 
> 

brain fart sorry, You are correct

-- 

David 1
bad addy
spamtrap@suescornerweb.com
From buzzard554 at fastmail.co.uk  Mon Jan  3 18:25:01 2005
From: buzzard554 at fastmail.co.uk (Martin Edwards)
Date: Mon Jan  3 13:25:03 2005
Subject: [SC-Help] One down
Message-ID: <crc2i8$m7i$1@news.spamcop.net>

I just got an account suspended by Easynet.
From firewoman at default.domain.not.available  Mon Jan  3 14:17:55 2005
From: firewoman at default.domain.not.available (Firewoman)
Date: Mon Jan  3 14:20:04 2005
Subject: [SC-Help] 
	Re: False Spamcop Positives on Yahoogroups Messages (66.94.237.42)
References: <cr6td6$fsc$1@news.spamcop.net> <cr6to0$g1k$1@news.spamcop.net>
	<cr6uqv$gnq$1@news.spamcop.net> <cr82p6$7d9$1@news.spamcop.net>
Message-ID: <crc5ls$ohr$1@news.spamcop.net>

"RW" <nobody@spamcop.net> wrote in message 
news:cr82p6$7d9$1@news.spamcop.net...
> "Robb Topolski" <autoreply@funchords.com> wrote in message 
> news:cr6uqv$gnq$1@news.spamcop.net...
>>
>> I still would like someone to take a peek and see if this is really 
>> abuse.
>
> I've been looking at the Yahoo IPs all day and yes, all the listings are 
> legit due to spam, mostly to spamtraps.  Yahoo doesn't do its users any 
> favours by allowing lists to be imported and subscriptions to be completed 
> without confirmations.

Yahoo doesn't do its users any favors when they allow groups to share user 
addresses to send out "invitations" to even more groups.

These invites weren't asked for, and I'm not even a member of any yahoo 
groups anymore.  (Note that I was a member of a total of TWO for about 2 
months.)

I'd say they're on the list for good reason. 


From DELETE_westes at earthbroadcast.com  Mon Jan  3 13:36:44 2005
From: DELETE_westes at earthbroadcast.com (CHANGE USERNAME TO westes)
Date: Mon Jan  3 16:35:03 2005
Subject: [SC-Help] How to Handle Reverse Delegation for Muti-IP mail Host
Message-ID: <crcdjh$u64$1@news.spamcop.net>

Many sites on the Internet no longer accept mail if the reverse IP does not
match the forward IP, using the domain name that sendmail announces when it
connects while sending mail.   I understand how to handle reverse delegation
to make these match for a simple case, but I have a question for a more
complex case.

We have our mail server connected to two different networks, for redundancy.
For receiving incoming mail, this works great, and we can set the MX records
to mail1.mysite.com and mail2.mysite.com, each of which resolves to an IP on
a different network.    Now how do I handle outgoing mail?   One solution
would be to have the generic host mail.mysite.com resolve to two different
IP addresses.   But I'm thinkingt that may cause problems.   The reverse
delegation for the two different IP addresses should show one hostname
(i.e., mail.mysite.com), but would there be other issues that make using
more than one IP for sending mail problematic?

-- 
Will
westes AT earthbroadcast.com


From TJLWBECGSGWU at spammotel.com  Mon Jan  3 23:34:21 2005
From: TJLWBECGSGWU at spammotel.com (Mathew Hendry)
Date: Mon Jan  3 18:35:03 2005
Subject: [SC-Help] Re: Wrong originating host?
References: <crbmsv$eh1$1@news.spamcop.net>
	<rnqit0t8p84bvb671c52eel97v3snp64h4@4ax.com> <crcd6k$tm2$1@news.spamcop.net>
Message-ID: <5hijt0h6fmurv6iibv0nu6u20g56eljaug@4ax.com>

[Crossposted and followups set to spamcop.help]

On Mon, 03 Jan 2005 22:24:36 +0100, Ernst <e.streit@bluewin.ch> wrote:

>Mat, I am sorry, but what is a tracker and how do I post it?

Sorry, the proper name is tracking URL, often called a tracker for short.
Each spam submitted gets its own unique URL. Look at the top of the page
next time you make a report; from one I sent a little while ago:

Here is your TRACKING URL - it may be saved for future reference:
http://www.spamcop.net/sc?id=z709033350z65a107e42491c0aef2adc56a91ab1d69z

If you see anything unusual or interesting when reporting, you can post the
tracking URL here for other people to look at. Make sure you send or cancel
the report first, though: a tracker that's still "live" could be used by
anyone to send reports in your name.

-- Mat.

From ric.gates at bigsleep.org  Tue Jan  4 04:20:19 2005
From: ric.gates at bigsleep.org (Blammo)
Date: Mon Jan  3 23:25:03 2005
Subject: [SC-Help] 
	Re: How to Handle Reverse Delegation for Muti-IP mail Host
References: <crcdjh$u64$1@news.spamcop.net>
Message-ID: <Xns95D3CEF04E012blammo@216.154.195.61>

On 03 Jan 2005 CHANGE USERNAME TO westes entered spamcop.help and left
news:crcdjh$u64$1@news.spamcop.net: 

> Many sites on the Internet no longer accept mail if the reverse IP
> does not match the forward IP, using the domain name that sendmail
> announces when it connects while sending mail.   I understand how to
> handle reverse delegation to make these match for a simple case, but I
> have a question for a more complex case.
> 
> We have our mail server connected to two different networks, for
> redundancy. For receiving incoming mail, this works great, and we can
> set the MX records to mail1.mysite.com and mail2.mysite.com, each of
> which resolves to an IP on a different network.    Now how do I handle
> outgoing mail?   One solution would be to have the generic host
> mail.mysite.com resolve to two different IP addresses.   But I'm
> thinkingt that may cause problems.   The reverse delegation for the
> two different IP addresses should show one hostname (i.e.,
> mail.mysite.com), but would there be other issues that make using more
> than one IP for sending mail problematic? 
> 

Two Sendmail daemons.
Sendmail will only use the primary domain for the server it's running on, 
or the domain it's set to - which should match the PTR of the outgoing 
connection IP anyway. Sounds like you are having problems because you set 
the domain to something else, or sendmail is not able to get the correct 
name.
http://www.sendmail.org/m4/tweaking_config.html#confDOMAIN_NAME
The MX names have nothing to do with it.

-- 
| Ric



-- 
| Ric
|
From jvm_cop at spamcop.net  Wed Jan  5 09:03:08 2005
From: jvm_cop at spamcop.net (J. Merrill)
Date: Wed Jan  5 09:05:03 2005
Subject: [SC-Help] Many questionable cases of "Cannot resolve"
Message-ID: <crgrur$si8$1@news.spamcop.net>

I have seen a substantial increase in the number of spams where
there is no identified web site.  In each case, the message
"Cannot resolve http://..." is part of the technical details --
as if the site has been taken down, and readers of the spam could
not successfully click on the links in the message.

In many cases, I have grabbed one or more of the non-resolvable
domains and used Windows 2000's command-line "ping" and seen that
ping is able to resolve these addresses, even though SpamCop's
server apparently cannot.

I know about DNS changes propagating at different speeds and so
on.  Many times, I have used "ipconfig /flushdns" to try to get
the freshest possible info.  If it weren't happening quite
consistently, I wouldn't be asking.

What I've done (when I feel inspired to take extra time for a
particular spam) is to use SpamCop to get a report of the IP
address that "ping" shows me, then modify the spam message by
adding something like

*** Spam reporter added:  http://202.102.230.36
*** because SpamCop could not resolve jkelwi.wise-sol.info

and have SpamCop re-parse the message.

Is that what I should be doing?  How can I know whether or not
the address that "ping" shows me is really involved?  Is there an
easy-to-use more-reliable way to get the "official" DNS status
for a domain?  (If the ISP has already taken the site down, will
this still count against its spam-friendliness rating?)

Thanks for any help.


From MikeE at ster.invalid  Wed Jan  5 06:23:47 2005
From: MikeE at ster.invalid (Mike Easter)
Date: Wed Jan  5 09:25:10 2005
Subject: [SC-Help] Re: Many questionable cases of "Cannot resolve"
References: <crgrur$si8$1@news.spamcop.net>
Message-ID: <crgt77$thd$1@news.spamcop.net>

J. Merrill wrote:
> What I've done (when I feel inspired to take extra time for a
> particular spam) is to use SpamCop to get a report of the IP
> address that "ping" shows me, then modify the spam message by
> adding something like
>
> *** Spam reporter added:  http://202.102.230.36
> *** because SpamCop could not resolve jkelwi.wise-sol.info
>
> and have SpamCop re-parse the message.

That /seems/ like that should be a very good way to accomplish something
which isn't permitted by the faq;  but it isn't authorized.

Ellen has said that simply 'doing it' ie just changing/modifying the
original spam to enable is a no-no.  Altho' your strategy 'documents'
the change better, I'm sure she isn't going to put her stamp of approval
on anything which isn't permitted by the faq.

> Is that what I should be doing?  How can I know whether or not
> the address that "ping" shows me is really involved?  Is there an
> easy-to-use more-reliable way to get the "official" DNS status
> for a domain?  (If the ISP has already taken the site down, will
> this still count against its spam-friendliness rating?)

My understanding is that modifying the spam in order to facilitate a
notify is a material change which isn't allowed.

Under those rules, a free spamcop reporter would not be able to make
such a notify;  whereas a paid spamcop reporter could do it another way.
The other way would be to add a notify to the spamcop report.  That is,
you would leave the original spam unchanged, you would determine the IP,
you could ask SC to give you the reporting addies for the IP, and then
you would add those reporting addies to the SC report.  You can't add
addies if you are a free reporter.

Re how to find the IP.

Ping isn't as good as some other tools, but it is good enough.  I
usually use SamSpade's console for Win, but it depends on what is 'open'
or available because I also use NetDemon's console for Win.  When I'm
'analyzing' whatall is wrong with a domainname re its nameservice I use
a number of different tools available online at dnsstuff
http://www.dnsstuff.com/  Some people like SamSpade online
http://samspade.org/

-- 
Mike Easter
kibitzer, not SC admin

From nobody at spamcop.net  Wed Jan  5 11:50:07 2005
From: nobody at spamcop.net (Ellen)
Date: Wed Jan  5 11:55:03 2005
Subject: [SC-Help] Re: Many questionable cases of "Cannot resolve"
References: <crgrur$si8$1@news.spamcop.net>
Message-ID: <crh602$3pf$1@news.spamcop.net>



"J. Merrill" <jvm_cop@spamcop.net> wrote in message
news:crgrur$si8$1@news.spamcop.net...
>
> *** Spam reporter added:  http://202.102.230.36
> *** because SpamCop could not resolve jkelwi.wise-sol.info

No you cannot do that. You *cannot* change urls in the spam to force them to
parse and you *cannot* add urls to the spam to force reports to be
generated. This is against the TOS which you agreed to when you opened your
account.

And yes, we are aware of the DNS resolution situation.

Ellen




From DELETE_westes at earthbroadcast.com  Wed Jan  5 10:28:35 2005
From: DELETE_westes at earthbroadcast.com (Will)
Date: Wed Jan  5 13:25:03 2005
Subject: [SC-Help] 
	Re: How to Handle Reverse Delegation for Muti-IP mail Host
References: <crcdjh$u64$1@news.spamcop.net>
	<Xns95D3CEF04E012blammo@216.154.195.61>
Message-ID: <crhbal$849$1@news.spamcop.net>

I'm making a different point.   Let me provide an example.    I'm going to
use private IP addresses, but imagine these were public IPs.

    host1.mysite.com    192.168.1.1
    host2.mysite.com    192.168.10.1

    host.mysite.com will have *both* forward and reverse set as:

                                        192.168.1.1
                                        192.168.10.1

So sendmail will announce host.mysite.com on all outgoing mail.    A reverse
IP check of either IP above will match host.mysite.com.

The problem is that the *forward* lookup on host.mysite.com will give *two*
IP addresses.   And what I am asking is will that cause problems for all of
these virus checkers out there that are rejecting 1/2 the valid e-mail they
receive from business correspondents based on some minute imperfection in
the DNS record setup.    If most software will only use the host
announcement by sendmail and a reverse IP lookup, then it is okay.   If
software does a forward lookup and is not written to deal with more than one
IP, then it could cause problems.

-- 
Will
westes AT earthbroadcast.com



"Blammo" <ric.gates@bigsleep.org> wrote in message
news:Xns95D3CEF04E012blammo@216.154.195.61...
> Two Sendmail daemons.
> Sendmail will only use the primary domain for the server it's running on,
> or the domain it's set to - which should match the PTR of the outgoing
> connection IP anyway. Sounds like you are having problems because you set
> the domain to something else, or sendmail is not able to get the correct
> name.
> http://www.sendmail.org/m4/tweaking_config.html#confDOMAIN_NAME
> The MX names have nothing to do with it.
>
> -- 
> | Ric


From jvm_cop at spamcop.net  Wed Jan  5 17:39:23 2005
From: jvm_cop at spamcop.net (J. Merrill)
Date: Wed Jan  5 17:40:03 2005
Subject: [SC-Help] Re: Many questionable cases of "Cannot resolve"
References: <crgrur$si8$1@news.spamcop.net> <crh602$3pf$1@news.spamcop.net>
Message-ID: <crhq6r$iu7$1@news.spamcop.net>

"Ellen" <nobody@spamcop.net> wrote in message
news:crh602$3pf$1@news.spamcop.net...
>
>
> "J. Merrill" <jvm_cop@spamcop.net> wrote in message
> news:crgrur$si8$1@news.spamcop.net...
> >
> > *** Spam reporter added:  http://202.102.230.36
> > *** because SpamCop could not resolve jkelwi.wise-sol.info
>
> No you cannot do that. You *cannot* change urls in the spam to
force them to
> parse and you *cannot* add urls to the spam to force reports to
be
> generated. This is against the TOS which you agreed to when you
opened your
> account.
>
> And yes, we are aware of the DNS resolution situation.
>
> Ellen

Thanks for the info.  I will stop doing that, and hope that "the
DNS resolution situation" gets better.


From TMHRVMFWREVN at spammotel.com  Wed Jan  5 23:25:14 2005
From: TMHRVMFWREVN at spammotel.com (Rob)
Date: Wed Jan  5 18:45:03 2005
Subject: [SC-Help] Re: Many questionable cases of "Cannot resolve"
References: <crgrur$si8$1@news.spamcop.net>
Message-ID: <crhu5a$lji$1@news.spamcop.net>


"J. Merrill" <jvm_cop@spamcop.net> wrote in message
news:crgrur$si8$1@news.spamcop.net...
> I have seen a substantial increase in the number of spams where
> there is no identified web site.  In each case, the message
> "Cannot resolve http://..." is part of the technical details --
> as if the site has been taken down, and readers of the spam could
> not successfully click on the links in the message.
>
>

I've been getting quite a few of those so I just tried a suggestion I
remember reading either here or in spamcop or spamcop.geeks.  I refreshed
the page and all URLs SpamCop couldn't resolve suddenly were resolved.  Just
hit refresh, it's almost instant.

Rob


From ric.gates at bigsleep.org  Thu Jan  6 03:27:25 2005
From: ric.gates at bigsleep.org (Blammo)
Date: Wed Jan  5 22:30:17 2005
Subject: [SC-Help] 
	Re: How to Handle Reverse Delegation for Muti-IP mail Host
References: <crcdjh$u64$1@news.spamcop.net>
	<Xns95D3CEF04E012blammo@216.154.195.61> <crhbal$849$1@news.spamcop.net>
Message-ID: <Xns95D5C5F8FD81Eblammo@216.154.195.61>

On 05 Jan 2005 Will entered spamcop.help and left
news:crhbal$849$1@news.spamcop.net: 

> The problem is that the *forward* lookup on host.mysite.com will give
> *two* IP addresses.   And what I am asking is will that cause problems
> for all of these virus checkers out there that are rejecting 1/2 the
> valid e-mail they receive from business correspondents based on some
> minute imperfection in the DNS record setup.    If most software will
> only use the host announcement by sendmail and a reverse IP lookup,
> then it is okay.   If software does a forward lookup and is not
> written to deal with more than one IP, then it could cause problems.
> 

That's interesting, but I don't think it should be a problem, not that I 
know a whole lot about DNS forward records. For example when Sendmail 
checks a connection it looks up the hostname for the connecting IP, then 
looks up the IP for that hostname. If they don't match it returns FORGED so 
that you may reject this type of mail...

${client_resolve}
    Holds the result of the resolve call for ${client_name}. Possible 
values are:

        OK resolved successfully
        FAIL permanent lookup failure
        FORGED forward lookup doesn't match reverse lookup
        TEMP temporary lookup failure

So you can block those with no PTR, or those that don't match,
Now I don't block this type of mail because some company servers don't have 
their own PTR, or more often they don't match. Their MX name may be 
mail.company.com but their PTR would be something like dsl-123.isp.com, and 
because they have dynamic addressing (actually I'm not sure why) the IPs 
(forward lookup) won't match. This forward lookup part is what I've been a 
little unclear on, usually when I check I get no IP at all. I'm going to 
look at that again and see if I can refresh my memory.

Another thing some servers do is to check the HELO name against the PTR, 
this also causes problems when the PTR record is their DSL name. A real 
effective way to block spam, but also blocks a lot of valid mail.
Normally this isn't a problem because Sendmail gets your fully qualified 
domain name by getting your host name using gethostname and then calling 
gethostbyname on the result. So you shouldn't have to define 
confDOMAIN_NAME. (BTW, I've noticed lately that many spams have the correct 
name there, so maybe they finally figured that out).

Will having two IPs cause the FORGED result mentioned above, which I think 
is what you are talking about? This shouldn't be a problem because 
according to the FAQ "If the client IP address does not appear in that 
list, then the may be forged tag is added", So it seems a list of IPs is 
returned and all are checked. If you end up having a problem you can 
correct that using DNS and Bind, I keep thinking I need to get that book - 
http://www.oreilly.com/catalog/dns4/
-- 
| Ric
|
From MikeE at ster.invalid  Thu Jan  6 09:30:12 2005
From: MikeE at ster.invalid (Mike Easter)
Date: Thu Jan  6 12:30:03 2005
Subject: [SC-Help] Re: out dated spam
References: <crjka2$kb0$1@news.spamcop.net>
Message-ID: <crjsgj$qo2$1@news.spamcop.net>

posted to .help & .spam;  f/ups to .help

Hal Blum wrote:
> I have been getting a lot ofspam lately that when I submit them
> (usually with in hours of receiving them) I get the message that it
> is too old, usually it wiull state received date as anything from 4
> to 10 days old. Is it possible that the date in the headers could be
> forged? exaple
www.spamcop.net/sc?id=z709956173z58ef79b6d70e37237b8b5755d45ab7dfz
> I received this last night but the syatem states that it is 7.5 days
> old... any ideas on this?

Route:  adelphia => speakeasy => blumfamily

Delay: speakeasy, 1 week.  Somehow that item didn't get from speakeasy
to your server in a timely fashion.


Incidentally:

housekeeping1:  .spam is for posting only raw spam, no raw spam is
allowed in .help or spamcop.  .help and spamcop are for discussing spam
issues and posting the trackers like you did.  If you are going to post
a tracker and a question, post into .help or spamcop not .spam.  No one
goes to .spam because there is only [supposed to be] raw spam in there.

housekeeping2:  newsgroup postings should be in plaintext, not html.  I
don't know where that is configured in your Groupwise newsreader.

-- 
Mike Easter
kibitzer, not SC admin

From forrie at Noforriesp.amcom  Fri Jan  7 02:42:09 2005
From: forrie at Noforriesp.amcom (Forrest Aldrich)
Date: Fri Jan  7 02:45:18 2005
Subject: [SC-Help] New mailhosts configuration (question)
Message-ID: <crlecp$s03$1@news.spamcop.net>

Hi there,

I've gone through the initial setup process for the new mailhost 
configuration on SpamCop.

I have a domain which I MX to my home system (cable modem).  For the 
most part, the IP address stays the same (although it is officially 
dynamic), as my system is on 24x7.

I listed the provider as the default that the form provided which is 
"mail.mydomain.com" - which in fact my "provider" is the ISP.

I just want to ensure I've not messed this up in any way.


Thanks.
From nobody at devnull.spamcop.net  Fri Jan  7 02:23:59 2005
From: nobody at devnull.spamcop.net (WazoO)
Date: Fri Jan  7 03:25:05 2005
Subject: [SC-Help] Re: New mailhosts configuration (question)
References: <crlecp$s03$1@news.spamcop.net>
Message-ID: <crlguv$tp9$1@news.spamcop.net>

"Forrest Aldrich" <forrie@Noforriesp.amcom> wrote in message
news:crlecp$s03$1@news.spamcop.net...
>
> I've gone through the initial setup process for the new mailhost
> configuration on SpamCop.

Responses already existing in the 'primary' support spot
for MailHost to your posting "over there" in the web-based
Forum thing.


From e.streit at bluewin.ch  Fri Jan  7 11:40:24 2005
From: e.streit at bluewin.ch (Ernst)
Date: Fri Jan  7 05:45:03 2005
Subject: [SC-Help] Re: Wrong originating host?
In-Reply-To: <5hijt0h6fmurv6iibv0nu6u20g56eljaug@4ax.com>
References: <crbmsv$eh1$1@news.spamcop.net>
	<rnqit0t8p84bvb671c52eel97v3snp64h4@4ax.com> <crcd6k$tm2$1@news.spamcop.net>
	<5hijt0h6fmurv6iibv0nu6u20g56eljaug@4ax.com>
Message-ID: <crlouo$3ah$1@news.spamcop.net>

Mat, here is now the URL of an e-mail, where my ISP was identified as 
the originating host.
http://www.spamcop.net/sc?id=z710204438zbd5b728184d6cb16f633d294acd99218z
Note the following: When I submitted the header again to SpamCop, it 
seems that it analyzed it then correctly, but I did not submit it again.

Another question: Under SpamCop I can look at my recent reports, but 
they don't seem to have their URL displayed.
Thanks and regards, Ernst

Mathew Hendry schrieb:
> [Crossposted and followups set to spamcop.help]
> 
> On Mon, 03 Jan 2005 22:24:36 +0100, Ernst <e.streit@bluewin.ch> wrote:
> 
> 
>>Mat, I am sorry, but what is a tracker and how do I post it?
> 
> 
> Sorry, the proper name is tracking URL, often called a tracker for short.
> Each spam submitted gets its own unique URL. Look at the top of the page
> next time you make a report; from one I sent a little while ago:
> 
> Here is your TRACKING URL - it may be saved for future reference:
> http://www.spamcop.net/sc?id=z709033350z65a107e42491c0aef2adc56a91ab1d69z
> 
> If you see anything unusual or interesting when reporting, you can post the
> tracking URL here for other people to look at. Make sure you send or cancel
> the report first, though: a tracker that's still "live" could be used by
> anyone to send reports in your name.
> 
> -- Mat.
> 

From nobody at spamcop.net  Fri Jan  7 08:00:59 2005
From: nobody at spamcop.net (Ellen)
Date: Fri Jan  7 08:05:05 2005
Subject: [SC-Help] Re: New mailhosts configuration (question)
References: <crlecp$s03$1@news.spamcop.net>
Message-ID: <crm19f$88d$3@news.spamcop.net>



"Forrest Aldrich" <forrie@Noforriesp.amcom> wrote in message
news:crlecp$s03$1@news.spamcop.net...
> Hi there,
>
> I've gone through the initial setup process for the new mailhost
> configuration on SpamCop.
>
> I have a domain which I MX to my home system (cable modem).  For the
> most part, the IP address stays the same (although it is officially
> dynamic), as my system is on 24x7.
>
> I listed the provider as the default that the form provided which is
> "mail.mydomain.com" - which in fact my "provider" is the ISP.
>
> I just want to ensure I've not messed this up in any way.
>

Parse one or more spams -- or any emails sent thru the mailpath that you are
concerned about -- and copy the tracking url from the top of the parse and
send it to me deputies <at> spamcop.net along with an explanation of your
concerns. Cancel the reports. I'll look at the parse and see if there is a
problem.

Ellen
SpamCop


From MikeE at ster.invalid  Fri Jan  7 05:04:56 2005
From: MikeE at ster.invalid (Mike Easter)
Date: Fri Jan  7 08:05:08 2005
Subject: [SC-Help] Re: Wrong originating host?
References: <crbmsv$eh1$1@news.spamcop.net>
	<rnqit0t8p84bvb671c52eel97v3snp64h4@4ax.com> <crcd6k$tm2$1@news.spamcop.net>
	<5hijt0h6fmurv6iibv0nu6u20g56eljaug@4ax.com> <crlouo$3ah$1@news.spamcop.net>
Message-ID: <crm1b4$890$1@news.spamcop.net>

Ernst wrote:
> Mat, here is now the URL of an e-mail, where my ISP was identified as
> the originating host.
www.spamcop.net/sc?id=z710204438zbd5b728184d6cb16f633d294acd99218z

  Abbreviated Received lines *comment
  from mx21.bluewin.ch (195.186.18.37) by mssazhh-int.msg.bluewin.ch
*serves you
  from host247-254.pool80117.interbusiness.it (80.117.254.247) by
mx21.bluewin.ch *sourceline
  from suspense (146.212.103.251) by 48.237.132.166 *bogusline

SC has to be able to chain from top toward the bottom by associating the
upper 'from' field with the lower 'by' field.  The MXes for bluewin are
195.186.3.80  & 195.186.6.80  which are not 'close enough' to
195.186.18.37 to pass what I call the 'MX step' until SC is familiar
with the relay by 'aging' or maturity after the relay has been sent to
relay testers.

If unfamiliar, the chaining fails prematurely in trying to go from the
top line to the 2nd line and SC would name mx21 at bluewin as source.
After maturing, mx21 becomes a 'trusted' server, that is, trusted to be
a server and SC can chain to the interbusiness source.

> Note the following: When I submitted the header again to SpamCop, it
> seems that it analyzed it then correctly, but I did not submit it
> again.

> Another question: Under SpamCop I can look at my recent reports, but
> they don't seem to have their URL displayed.

Correct.  Us citizens cannot simply take a report id and convert it to a
tracking URL.  We have to grab that during the parse.  Only a deputy who
has access to evidence can dig up the evidence with only a report id.


-- 
Mike Easter
kibitzer, not SC admin

From gospamming at yourdomain.invalid  Fri Jan  7 13:14:37 2005
From: gospamming at yourdomain.invalid (D.Diaz)
Date: Fri Jan  7 08:15:03 2005
Subject: [SC-Help] Re: Wrong originating host?
References: <crbmsv$eh1$1@news.spamcop.net>
	<rnqit0t8p84bvb671c52eel97v3snp64h4@4ax.com> <crcd6k$tm2$1@news.spamcop.net>
	<5hijt0h6fmurv6iibv0nu6u20g56eljaug@4ax.com> <crlouo$3ah$1@news.spamcop.net>
	<crm1b4$890$1@news.spamcop.net>
Message-ID: <Xns95D790E4C81ABxnddmxn@216.154.195.61>

"Mike Easter" <MikeE@ster.invalid> wrote in
news:crm1b4$890$1@news.spamcop.net: 

> Correct.  Us citizens cannot simply take a report id and convert it to
> a tracking URL.  We have to grab that during the parse.  Only a deputy
> who has access to evidence can dig up the evidence with only a report
> id. 
> 

AFAICT, if the report id is from one of your own reports, you can. You
click on "Past Reports", then enter the report ID or browse through
"recent reports" and click on any of them.  You will see the report and,
on top of it, a link which says "Parse".  You click on it and you get
the usual parse page. 

-- 
Daniel Diaz
SpamCop User
From MikeE at ster.invalid  Fri Jan  7 05:58:00 2005
From: MikeE at ster.invalid (Mike Easter)
Date: Fri Jan  7 09:00:03 2005
Subject: [SC-Help] Re: Wrong originating host?
References: <crbmsv$eh1$1@news.spamcop.net>
	<rnqit0t8p84bvb671c52eel97v3snp64h4@4ax.com> <crcd6k$tm2$1@news.spamcop.net>
	<5hijt0h6fmurv6iibv0nu6u20g56eljaug@4ax.com> <crlouo$3ah$1@news.spamcop.net>
	<crm1b4$890$1@news.spamcop.net> <Xns95D790E4C81ABxnddmxn@216.154.195.61>
Message-ID: <crm4ek$aoe$1@news.spamcop.net>

D.Diaz wrote:
> "Mike Easter"

>> Correct.  Us citizens cannot simply take a report id and convert it
>> to a tracking URL.  We have to grab that during the parse.  Only a
>> deputy who has access to evidence can dig up the evidence with only
>> a report id.

Errk.  If I'm going to cite myself, change that to 'we citizens'

> AFAICT, if the report id is from one of your own reports, you can. You
> click on "Past Reports", then enter the report ID or browse through
> "recent reports" and click on any of them.  You will see the report
> and, on top of it, a link which says "Parse".  You click on it and
> you get the usual parse page.

Just before posting that, I made an effort to dredge up a parse, but I
couldn't.

I'm going past reports > recent reports > a report id -- but I see no
'parse' link, just who got the reports.


-- 
Mike Easter
kibitzer, not SC admin

From MikeE at ster.invalid  Fri Jan  7 06:01:01 2005
From: MikeE at ster.invalid (Mike Easter)
Date: Fri Jan  7 09:00:06 2005
Subject: [SC-Help] Re: Wrong originating host?
References: <crbmsv$eh1$1@news.spamcop.net>
	<rnqit0t8p84bvb671c52eel97v3snp64h4@4ax.com> <crcd6k$tm2$1@news.spamcop.net>
	<5hijt0h6fmurv6iibv0nu6u20g56eljaug@4ax.com> <crlouo$3ah$1@news.spamcop.net>
	<crm1b4$890$1@news.spamcop.net> <Xns95D790E4C81ABxnddmxn@216.154.195.61>
Message-ID: <crm4k8$apt$1@news.spamcop.net>

D.Diaz wrote:
> AFAICT, if the report id is from one of your own reports, you can. You
> click on "Past Reports", then enter the report ID or browse through
> "recent reports" and click on any of them.  You will see the report
> and, on top of it, a link which says "Parse".  You click on it and
> you get the usual parse page.

I think that's a paying customer perq.

http://www.spamcop.net/fom-serve/cache/288.html  Upgrade to a premium
member account
Access to the database to check reports you have sent in the past 30
days;


-- 
Mike Easter
kibitzer, not SC admin

From hblum at manhard.com  Fri Jan  7 10:00:59 2005
From: hblum at manhard.com (Hal Blum)
Date: Fri Jan  7 11:05:02 2005
Subject: [SC-Help] Re: out dated spam
References: <crjka2$kb0$1@news.spamcop.net> <crjsgj$qo2$1@news.spamcop.net>
Message-ID: <crmbmv$f8v$1@news.spamcop.net>

Thanks
From gospamming at yourdomain.invalid  Fri Jan  7 16:09:46 2005
From: gospamming at yourdomain.invalid (D.Diaz)
Date: Fri Jan  7 11:10:03 2005
Subject: [SC-Help] Re: Wrong originating host?
References: <crbmsv$eh1$1@news.spamcop.net>
	<rnqit0t8p84bvb671c52eel97v3snp64h4@4ax.com> <crcd6k$tm2$1@news.spamcop.net>
	<5hijt0h6fmurv6iibv0nu6u20g56eljaug@4ax.com> <crlouo$3ah$1@news.spamcop.net>
	<crm1b4$890$1@news.spamcop.net> <Xns95D790E4C81ABxnddmxn@216.154.195.61>
	<crm4ek$aoe$1@news.spamcop.net>
Message-ID: <Xns95D7AE8F8F354xnddmxn@216.154.195.61>

"Mike Easter" <MikeE@ster.invalid> wrote in
news:crm4ek$aoe$1@news.spamcop.net: 

> Just before posting that, I made an effort to dredge up a parse, but I
> couldn't.
> 
> I'm going past reports > recent reports > a report id -- but I see no
> 'parse' link, just who got the reports.
> 

Click on a report number to see the actual report which was sent to that
address.  At the top will be the "Parse" link. 


"Mike Easter" <MikeE@ster.invalid> wrote in
news:crm4k8$apt$1@news.spamcop.net: 

> I think that's a paying customer perq.
> 

Nope. I'm a free reporting user.

-- 
Daniel Diaz
SpamCop User
From MikeE at ster.invalid  Fri Jan  7 08:22:53 2005
From: MikeE at ster.invalid (Mike Easter)
Date: Fri Jan  7 11:25:02 2005
Subject: [SC-Help] Re: Wrong originating host?
References: <crbmsv$eh1$1@news.spamcop.net>
	<rnqit0t8p84bvb671c52eel97v3snp64h4@4ax.com> <crcd6k$tm2$1@news.spamcop.net>
	<5hijt0h6fmurv6iibv0nu6u20g56eljaug@4ax.com> <crlouo$3ah$1@news.spamcop.net>
	<crm1b4$890$1@news.spamcop.net> <Xns95D790E4C81ABxnddmxn@216.154.195.61>
	<crm4ek$aoe$1@news.spamcop.net> <Xns95D7AE8F8F354xnddmxn@216.154.195.61>
Message-ID: <crmcu8$gcj$1@news.spamcop.net>

D.Diaz wrote:
> "Mike Easter"
>> Just before posting that, I made an effort to dredge up a parse, but
>> I couldn't.
>>
>> I'm going past reports > recent reports > a report id -- but I see no
>> 'parse' link, just who got the reports.
>>
>
> Click on a report number to see the actual report which was sent to
> that address.  At the top will be the "Parse" link.

Not happening here.  I click report id # as above.  The word parse does
not appear.

Oops.  Retract that.  If I click the report id for the spamvertiser, no
'parse', no spam.  If I click the report id for the source, I get a spam
and a parse option.


-- 
Mike Easter
kibitzer, not SC admin

From gospamming at yourdomain.invalid  Fri Jan  7 16:48:00 2005
From: gospamming at yourdomain.invalid (D.Diaz)
Date: Fri Jan  7 11:50:03 2005
Subject: [SC-Help] Re: Wrong originating host?
References: <crbmsv$eh1$1@news.spamcop.net>
	<rnqit0t8p84bvb671c52eel97v3snp64h4@4ax.com> <crcd6k$tm2$1@news.spamcop.net>
	<5hijt0h6fmurv6iibv0nu6u20g56eljaug@4ax.com> <crlouo$3ah$1@news.spamcop.net>
	<crm1b4$890$1@news.spamcop.net> <Xns95D790E4C81ABxnddmxn@216.154.195.61>
	<crm4ek$aoe$1@news.spamcop.net> <Xns95D7AE8F8F354xnddmxn@216.154.195.61>
	<crmcu8$gcj$1@news.spamcop.net>
Message-ID: <Xns95D7B5135541Cxnddmxn@216.154.195.61>

"Mike Easter" <MikeE@ster.invalid> wrote in
news:crmcu8$gcj$1@news.spamcop.net: 

> Oops.  Retract that.  If I click the report id for the spamvertiser,
> no 'parse', no spam.  If I click the report id for the source, I get a
> spam and a parse option.
> 

Gee, that's true. I didn't notice that the spamvertiser report page is
completely different... Until you mentioned it, I only happened to click
on spam source report IDs. 

-- 
Daniel Diaz
SpamCop User
From MikeE at ster.invalid  Sat Jan  8 15:59:26 2005
From: MikeE at ster.invalid (Mike Easter)
Date: Sat Jan  8 19:00:03 2005
Subject: [SC-Help] Re: What is this?
References: <41E06DAD.6030007@hotmail.com>
Message-ID: <crps25$ks6$1@news.spamcop.net>

Steve Milano wrote:
> Sorry if I'm in the wrong forum.

.mail is for newsgroup discussing problems with the spamcop mail
service.   I'll crosspost this to .help and set f/ups there.

> I keep getting this e-mail over and over.
>
> There's no return or from address.

Return/from addresses on spams and virms are almost always bogus anyway.
Disregard them;  that is information useful only for normal mail.

> SpamCop says there's no body provided, so I can't report it.
>
> Any ideas?

That item is apparently an empty spam sourced from 68.117.145.90  rDNS
ip-wv-68-117-145-090.charterwv.net  notify  abuse@charter.net  which is
multilisted in spamcop and other spamsource db/s and also in
trojan/proxy db/s.

> Received: from ip-wv-68-117-145-090.charterwv.net ([68.117.145.90])

SC is configured to not 'allow' reporting of empty spams because many
times when people submit such an item it is felt to be an error in
submission method.

There is some controversy over whether or not it is permissible to add
some words to the empty body after a blank line below the headers such
as 'no body text' to enable the report on empty spam.

The faq doesn't permit that action;  no deputy has approved something
different from the faq's permission;  but it is common practice for some
people to advise making such an entry in the body, while others don't do
that since it isn't expressly permitted.

That item is also missing a number of other header elements, such as To,
Subject, MessageID.  Previously such a deficient item would fail to be
parsed for insufficient header elements;  apparently that part of the
algorithm has changed.  It will now process a spam if there is only just
a Received line and offer to send a report as long as there is something
in the body.

-- 
Mike Easter
kibitzer, not SC admin

From jeff.simon.2 at sbcglobal.net  Sun Jan  9 13:35:15 2005
From: jeff.simon.2 at sbcglobal.net (Jeff)
Date: Sun Jan  9 13:40:02 2005
Subject: [SC-Help] Internal Spamcop Reporting?
Message-ID: <crrth3$re6$1@news.spamcop.net>

I keep seeing Internal Spamcop Reporting for this one ISP.  It says Internal 
Spamcop Reporting for Level3.  Why does it say that?  Does Spamcop handle 
the Spammer or does it get done by the ISP?  Spamcop is too confusing at 
times!! 


From nobody at spamcop.net  Sun Jan  9 15:11:23 2005
From: nobody at spamcop.net (Miss Betsy)
Date: Sun Jan  9 15:10:02 2005
Subject: [SC-Help] Re: Internal Spamcop Reporting?
References: <crrth3$re6$1@news.spamcop.net>
Message-ID: <crs2vl$v36$1@news.spamcop.net>


"Jeff" <jeff.simon.2@sbcglobal.net> wrote in message
news:crrth3$re6$1@news.spamcop.net...
> I keep seeing Internal Spamcop Reporting for this one ISP.  It
says Internal
> Spamcop Reporting for Level3.  Why does it say that?  Does
Spamcop handle
> the Spammer or does it get done by the ISP?  Spamcop is too
confusing at
> times!!

Some of the larger ISP's have arranged with spamcop to report to a
special abuse address rather than the publically announced one.  I
don't know if that means that spamcop reports get a higher priority
for action or just reduces the size of the inbox for the normal
abuse desk.  However, it doesn't mean anything more than the
address spamcop reports go to is not the same address as the normal
one.

Miss Betsy



From agent01413 at my-deja.com  Sun Jan  9 20:50:39 2005
From: agent01413 at my-deja.com (Socks)
Date: Sun Jan  9 15:55:03 2005
Subject: [SC-Help] Re: Internal Spamcop Reporting?
References: <crrth3$re6$1@news.spamcop.net> <crs2vl$v36$1@news.spamcop.net>
Message-ID: <Xns95D98CA9C4C60agent01413MYDEJACOM@216.154.195.61>

"Miss Betsy" <nobody@spamcop.net> wrote in news:crs2vl$v36$1
@news.spamcop.net:

> 
> "Jeff" <jeff.simon.2@sbcglobal.net> wrote in message
> news:crrth3$re6$1@news.spamcop.net...
>> I keep seeing Internal Spamcop Reporting for this one ISP.  It
> says Internal
>> Spamcop Reporting for Level3.  Why does it say that?  Does
> Spamcop handle
>> the Spammer or does it get done by the ISP?  Spamcop is too
> confusing at
>> times!!
> 
> Some of the larger ISP's have arranged with spamcop to report to a
> special abuse address rather than the publically announced one.  I
> don't know if that means that spamcop reports get a higher priority
> for action or just reduces the size of the inbox for the normal
> abuse desk.  However, it doesn't mean anything more than the
> address spamcop reports go to is not the same address as the normal
> one.
> 

It means that Level3 /dev/nulls a smaller number of reports.  While Miss 
Betsy's analysis is correct, Level3 has a track record of ignoring reports. 
This special reporting isnt going to result in a spammer being acted on.
From nobody at spamcop.net  Mon Jan 10 15:10:42 2005
From: nobody at spamcop.net (Miss Betsy)
Date: Mon Jan 10 15:15:03 2005
Subject: [SC-Help] Re: Internal Spamcop Reporting?
References: <crrth3$re6$1@news.spamcop.net> <crs2vl$v36$1@news.spamcop.net>
	<Xns95D98CA9C4C60agent01413MYDEJACOM@216.154.195.61>
Message-ID: <crunhc$l8p$1@news.spamcop.net>


"Socks" <agent01413@my-deja.com> wrote in message
news:Xns95D98CA9C4C60agent01413MYDEJACOM@216.154.195.61...
> "Miss Betsy" <nobody@spamcop.net> wrote in news:crs2vl$v36$1
> @news.spamcop.net:
>
> >
> > "Jeff" <jeff.simon.2@sbcglobal.net> wrote in message
> > news:crrth3$re6$1@news.spamcop.net...
> >> I keep seeing Internal Spamcop Reporting for this one ISP.  It
> > says Internal
> >> Spamcop Reporting for Level3.  Why does it say that?  Does
> > Spamcop handle
> >> the Spammer or does it get done by the ISP?  Spamcop is too
> > confusing at
> >> times!!
> >
> > Some of the larger ISP's have arranged with spamcop to report to a
> > special abuse address rather than the publically announced one.  I
> > don't know if that means that spamcop reports get a higher priority
> > for action or just reduces the size of the inbox for the normal
> > abuse desk.  However, it doesn't mean anything more than the
> > address spamcop reports go to is not the same address as the normal
> > one.
> >
>
> It means that Level3 /dev/nulls a smaller number of reports.  While
Miss
> Betsy's analysis is correct, Level3 has a track record of ignoring
reports.
> This special reporting isnt going to result in a spammer being acted
on.

OTOH, for other ISPs it may mean quicker action because they put
spamcop reports on a higher priority.  One has to know the reputation
of the ISP to know.  though in general, the ones who have special
addresses are the ones that get a lot of reports which means that they
aren't as good about spam control as others.

Miss Betsy


From mcwebber at my-deja.com  Tue Jan 11 11:10:03 2005
From: mcwebber at my-deja.com (McWebber)
Date: Tue Jan 11 11:10:04 2005
Subject: [SC-Help] roving.com spammers stay out of spamcop
Message-ID: <cs0tlo$14g$1@news.spamcop.net>

What is the deal with Spamcop and roving.com? It seems they are listed
everywhere except Spamcop. I find it hard to believe since my spamtraps, and
apparently lots of other spamtraps, are being hit by them that no Spamcop
spamtraps are hit. Is it because they cut some kind of deal with Ironport
that keeps them out of Spamcop? I got spammed by them recently because they
allow customers to use very dirty lists.

http://www.senderbase.org/search?searchBy=ipaddress&searchString=63.251.135.96

http://us.openrbl.org/ip/63/251/135/96.htm

Even 63.251.135.74 which isn't in the "Bonded Sender" program is listed
everywhere else but somehow manages to stay out of Spamcop.
http://us.openrbl.org/ip/63/251/135/74.htm

-- 
McWebber
No email replies read
If someone tells you to forward an email to all your friends
please forget that I'm your friend.


From Merlyn at Spamcop.net  Tue Jan 11 11:17:22 2005
From: Merlyn at Spamcop.net (Merlyn)
Date: Tue Jan 11 11:20:02 2005
Subject: [SC-Help] Re: roving.com spammers stay out of spamcop
References: <cs0tlo$14g$1@news.spamcop.net>
Message-ID: <cs0u6i$1gl$1@news.spamcop.net>

"McWebber" <mcwebber@my-deja.com> wrote in message 
news:cs0tlo$14g$1@news.spamcop.net...
> What is the deal with Spamcop and roving.com? It seems they are listed
> everywhere except Spamcop. I find it hard to believe since my spamtraps, 
> and
> apparently lots of other spamtraps, are being hit by them that no Spamcop
> spamtraps are hit. Is it because they cut some kind of deal with Ironport
> that keeps them out of Spamcop? I got spammed by them recently because 
> they
> allow customers to use very dirty lists.
>
> http://www.senderbase.org/search?searchBy=ipaddress&searchString=63.251.135.96
>
> http://us.openrbl.org/ip/63/251/135/96.htm
>
> Even 63.251.135.74 which isn't in the "Bonded Sender" program is listed
> everywhere else but somehow manages to stay out of Spamcop.
> http://us.openrbl.org/ip/63/251/135/74.htm
>


Spamhause recently re-added them:

A snippet from Spamhaus
<start snippet>
"Spamming to spamtraps for Berklee Music. Not only did the spammed spamtrap 
never opt in, it was actually *opted out* from their lists well over a year 
ago...several times...but continually spammed over and over.

Dirty lists - opt-outs keep getting re-added over and over and over again... 
It's time to permanently opt-out Roving software as a whole to solve this 
problem with continual spamming."
<end snippet>

Their record looks terrible, more here: 
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL5133

They are also listed in:

WSFF, open relays and more: will-spam-for-food.eu.org -> 127.0.0.1
roving.com

INTERSIL lists...spammers...who have pestered users at Intersil: 
blackholes.intersil.net -> roving.com.spam.blackholes.intersil.net. -> 
127.0.0.2
roving.com.spam.blackholes.intersil.net.
2003Jan02; 63.251.135.96/27 pnap.net
Roving Software Inc./Constant Contact
idiots actually spammed blockme@relays.osirusoft.com
2002Jan13; 208.198.98/27 uunet
2002Jan13; 63.251.135.64/27 pnap
2002Oct30; 204.167.97.64/29 genuity


SPAMBAG Spambags: blacklist.spambag.org -> pnap.blacklist.spambag.org. -> 
127.0.0.2
pnap.blacklist.spambag.org.
Blocked - see http://www.spambag.org/cgi-bin/spambag?mailfrom=pnap

JAMDSBL local bl at JAMMConsulting.com: dnsbl.jammconsulting.com -> 
127.0.0.2

AHBL The Abusive Hosts Blocking List: dnsbl.ahbl.org -> 127.0.0.4
1067181843 (Sun Oct 26 16:24:03 2003) bruns - Spam Source - 
63.251.135.0/24 - roving.com

ISIPPIADB ISIPP Accreditation Database: iadb.isipp.com -> 127.0.2.1 -> 
127.2.255.102 -> 127.3.100.7 -> 127.0.0.1 -> 127.0.0.2

ISIPPIADB2 ISIPP Accreditation Database different return type: 
iadb2.isipp.com -> 127.0.0.50

KROPKAALL Quite aggressive database, maintained by a few private persons: 
all.rbl.kropka.net -> 127.0.0.1

KROPKAIP kropka ip: ip.rbl.kropka.net -> 127.0.0.1

SORBS Spam and Open Relay Blocking System: Aggregate zone: 
dnsbl.sorbs.net -> 127.0.0.6
Spam Received See: http://www.dnsbl.sorbs.net/lookup.shtml?63.251.135.96

SORBSSPAM List of hosts that have been noted as sending spam/UCE/UBE to the 
admins of SORBS. : spam.dnsbl.sorbs.net -> 127.0.0.6
Spam Received See: http://www.dnsbl.sorbs.net/lookup.shtml?63.251.135.96

SORBSSPEWS-L1 Spam Prevention Early Warning System - Level 1 Mirror: 
l1.spews.dnsbl.sorbs.net -> 127.0.0.2
! [1] roving/constantcontact, see http://spews.org/ask.cgi?S1641

SORBSSPEWS-L2 Spam Prevention Early Warning System - Level 2 Mirror: 
l2.spews.dnsbl.sorbs.net -> 127.0.0.2
! [1] roving/constantcontact, see http://spews.org/ask.cgi?S1641

DNSBLAUT1 Reynolds Technology Type 1: t1.dnsbl.net.au -> 127.0.0.2
63.251.135.96 See http://dnsbl.ahbl.org/ and 
http://dnsbl.net.au/lookup/?ip=63.251.135.96
see http://dnsbl.net.au/rmst/ and http://dnsbl.net.au/lookup/?63.251.135.96

DNSBLAURMST dnsbl.net.au Multiple Spam Traps: rmst.dnsbl.net.au -> 127.0.0.2
see http://dnsbl.net.au/rmst/ and http://dnsbl.net.au/lookup/?63.251.135.96

DNSBLAUSPEWS Spam Prevention Early Warning System: spews.dnsbl.net.au -> 
127.0.0.2
63.251.135.96 See http://spews.org/ and http://www.dnsbl.net.au/spews/

DRBL-VOTE-GREMLIN Distributed RBL node: gremlin.ru: vote.drbl.gremlin.ru -> 
127.0.0.2
Spam source

DRBL-WORK-GREMLIN Distributed RBL node: gremlin.ru: work.drbl.gremlin.ru -> 
127.0.0.2
vote.drbl.gremlin.ru@ns.gremlin.ru:Spam source

BUSSPEWS Spam Prevention Early Warning System: spews.blackholes.us -> 
127.1.0.1
[1] roving/constantcontact, see http://spews.org/ask.cgi?S1641

This one will be fun to follow as they can surely not be in these spam lists 
and Ironports Boneded Sender whitelists at the same time.

-- 

Regards,
Merlyn

A Spamcop advocate
No emails this account is for newsgroups only
People demand freedom of speech to make up for the freedom of thought which 
they avoided 


From mcwebber at my-deja.com  Tue Jan 11 11:31:10 2005
From: mcwebber at my-deja.com (McWebber)
Date: Tue Jan 11 11:30:03 2005
Subject: [SC-Help] Re: roving.com spammers stay out of spamcop
References: <cs0tlo$14g$1@news.spamcop.net> <cs0u6i$1gl$1@news.spamcop.net>
Message-ID: <cs0utb$1th$1@news.spamcop.net>

"Merlyn" <Merlyn@Spamcop.net> wrote in message
news:cs0u6i$1gl$1@news.spamcop.net...
> "McWebber" <mcwebber@my-deja.com> wrote in message
> news:cs0tlo$14g$1@news.spamcop.net...
> > What is the deal with Spamcop and roving.com? It seems they are listed
> > everywhere except Spamcop. I find it hard to believe since my spamtraps,
> > and
>
> This one will be fun to follow as they can surely not be in these spam
lists
> and Ironports Boneded Sender whitelists at the same time.
>

Apparently they can since they are.

http://groups.google.co.uk/groups?hl=en&lr=&selm=6ve0u056p9skcmk71ilfkk00ct4q6gdspe%404ax.com

http://news.spamcop.net/pipermail/spamcop-list/2003-December/067678.html

Maybe they should change the name to Bonded Spammer.
-- 
McWebber
"Richter points to the lack of legal action against his company as proof
that he's operating appropriately."
Information Week, November 10, 2003


From Merlyn at Spamcop.net  Tue Jan 11 11:40:49 2005
From: Merlyn at Spamcop.net (Merlyn)
Date: Tue Jan 11 11:45:03 2005
Subject: [SC-Help] Re: roving.com spammers stay out of spamcop
References: <cs0tlo$14g$1@news.spamcop.net> <cs0u6i$1gl$1@news.spamcop.net>
	<cs0utb$1th$1@news.spamcop.net>
Message-ID: <cs0vig$2eg$1@news.spamcop.net>

"McWebber" <mcwebber@my-deja.com> wrote in message 
news:cs0utb$1th$1@news.spamcop.net...
> "Merlyn" <Merlyn@Spamcop.net> wrote in message
> news:cs0u6i$1gl$1@news.spamcop.net...
>> "McWebber" <mcwebber@my-deja.com> wrote in message
>> news:cs0tlo$14g$1@news.spamcop.net...
>> > What is the deal with Spamcop and roving.com? It seems they are listed
>> > everywhere except Spamcop. I find it hard to believe since my 
>> > spamtraps,
>> > and
>>
>> This one will be fun to follow as they can surely not be in these spam
> lists
>> and Ironports Boneded Sender whitelists at the same time.
>>
>
> Apparently they can since they are.
>
> http://groups.google.co.uk/groups?hl=en&lr=&selm=6ve0u056p9skcmk71ilfkk00ct4q6gdspe%404ax.com
>
> http://news.spamcop.net/pipermail/spamcop-list/2003-December/067678.html
>
> Maybe they should change the name to Bonded Spammer.


Their initials say it all, Bonded Sender :-)

-- 

Regards,
Merlyn

A Spamcop advocate
No emails this account is for newsgroups only
People demand freedom of speech to make up for the freedom of thought which 
they avoided 


From MikeE at ster.invalid  Tue Jan 11 09:31:01 2005
From: MikeE at ster.invalid (Mike Easter)
Date: Tue Jan 11 12:30:07 2005
Subject: [SC-Help] Re: roving.com spammers stay out of spamcop
References: <cs0tlo$14g$1@news.spamcop.net>
Message-ID: <cs12dk$49m$1@news.spamcop.net>

McWebber wrote:
> What is the deal with Spamcop and roving.com?

It looks like the 'majority' opinion in nanae is that bonded
senders/spammers don't get listed in spamcop.

snurled .uk googleup of 27 articles http://snipurl.com/bxmo

Newsgroups: news.admin.net-abuse.email
Subject: Another Bonded Spammer: "roving.com"
Message-ID: <M_TDd.9469$5R.178@newssvr21.news.prodigy.com>
Date: Sat, 08 Jan 2005 16:37:00 GMT




-- 
Mike Easter
kibitzer, not SC admin

From gospamming at yourdomain.invalid  Tue Jan 11 17:51:11 2005
From: gospamming at yourdomain.invalid (D.Diaz)
Date: Tue Jan 11 12:55:03 2005
Subject: [SC-Help] Re: roving.com spammers stay out of spamcop
References: <cs0tlo$14g$1@news.spamcop.net>
Message-ID: <Xns95DBBFC891AE3xnddmxn@216.154.195.61>

"McWebber" <mcwebber@my-deja.com> wrote in
news:cs0tlo$14g$1@news.spamcop.net: 

> What is the deal with Spamcop and roving.com? It seems they are listed
> everywhere except Spamcop. I find it hard to believe since my
> spamtraps, and apparently lots of other spamtraps, are being hit by
> them that no Spamcop spamtraps are hit. Is it because they cut some
> kind of deal with Ironport that keeps them out of Spamcop? I got
> spammed by them recently because they allow customers to use very
> dirty lists. 
> 
> http://www.senderbase.org/search?searchBy=ipaddress&searchString=63.251
> .135.96 
> 
> http://us.openrbl.org/ip/63/251/135/96.htm
> 
> Even 63.251.135.74 which isn't in the "Bonded Sender" program is
> listed everywhere else but somehow manages to stay out of Spamcop.
> http://us.openrbl.org/ip/63/251/135/74.htm
> 


No deal, but just the way the weighting algorithm works, I think.

http://www.spamcop.net/fom-serve/cache/297.html

[quoting relevant part: "How the SCBL Works"]

The SCBL weights the number of reports referencing an IP against a
sample of the total amount of email sent by that IP. This method is not
perfect. For example, some IPs which send a significant amount of
reported mail may rarely or never be listed in the SCBL because those
IPs also send a lot of non-reported mail. 

[/quote]


Let's have a look at the SenderBase stats for the 63.251.135.0/24 block:

http://www.spamcop.net/w3m?action=map;mask=65535;net=1073414144;sort=ipsort

At the time I'm seeing the stats page, there are 15 hosts in that block,
sending a mail volume of 311319.00, and there are only 42 spam reports
for 3 of those 15 hosts. 

Also, a Google search in NANAS for 63.251.135.74 (the SBL listing you
mentioned) gives a total amount of only 11 sightings reported in the
year 2004, and none at all this month:

http://www.google.com/groups?as_ugroup=news.admin.net-abuse.sightings&as_scoring=d&num=100&as_q=63.251.135.74

Of course, still remains the question about the SpamCop spamtraps... 
How many hits are they receiving? Is that number so small to not trigger
a listing, given their "multiplicative" effect in the weighting
algorithm? 

It's also a pity to not have access anymore to the "history of
previous listings" for an IP address.  It would be interesting to dig in
there the past history of those IP addresses... 


-- 
Daniel Diaz
SpamCop User
From nobody at spamcop.net  Tue Jan 11 13:07:20 2005
From: nobody at spamcop.net (Pop)
Date: Tue Jan 11 13:10:03 2005
Subject: [SC-Help] Re: roving.com spammers stay out of spamcop
References: <cs0tlo$14g$1@news.spamcop.net> <cs12dk$49m$1@news.spamcop.net>
Message-ID: <cs14kn$601$1@news.spamcop.net>

Mike Easter wrote:
> McWebber wrote:
>> What is the deal with Spamcop and roving.com?
> 
> It looks like the 'majority' opinion in nanae is that bonded
> senders/spammers don't get listed in spamcop.
> 
> snurled .uk googleup of 27 articles http://snipurl.com/bxmo
> 
> Newsgroups: news.admin.net-abuse.email
> Subject: Another Bonded Spammer: "roving.com"
> Message-ID: <M_TDd.9469$5R.178@newssvr21.news.prodigy.com>
> Date: Sat, 08 Jan 2005 16:37:00 GMT

There are probably no readers left who remember what I'm talking about, -but- I "told you so"!

Business rule #1:  Make money - do good for the public if it doesn't get in the way of profit
Business rule #2:  Make more money any way you can expand in and the hell with the public
Business rule #3:  Promote good will unless it gets in the way of profits; rule #2 not working.
Business rule #4:  Buy, kill, infiltrate or otherwise negate the competition; screw the public.  
Business rule #5:  If profits are stagnant, see rule #1, 2, 3, and 4.
Business rule #6:  You're fired!  Screw the public.  Forget good will; it didn't work.  Anyone not with us is ag'in' us!

Not sure what I'm going to do about it yet - looks like a GREAT opportunity for someone out there!  I'm keeping my eyes open, believe me!

-- 
Pop

From Merlyn at Spamcop.net  Tue Jan 11 13:19:29 2005
From: Merlyn at Spamcop.net (Merlyn)
Date: Tue Jan 11 13:20:03 2005
Subject: [SC-Help] Re: roving.com spammers stay out of spamcop
References: <cs0tlo$14g$1@news.spamcop.net>
	<Xns95DBBFC891AE3xnddmxn@216.154.195.61>
Message-ID: <cs15bh$6h0$1@news.spamcop.net>

"D.Diaz" <gospamming@yourdomain.invalid> wrote in message 
news:Xns95DBBFC891AE3xnddmxn@216.154.195.61...
>
> No deal, but just the way the weighting algorithm works, I think.
>
> http://www.spamcop.net/fom-serve/cache/297.html
>
> [quoting relevant part: "How the SCBL Works"]
>
> The SCBL weights the number of reports referencing an IP against a
> sample of the total amount of email sent by that IP. This method is not
> perfect. For example, some IPs which send a significant amount of
> reported mail may rarely or never be listed in the SCBL because those
> IPs also send a lot of non-reported mail.
>
> [/quote]
>
>
> Let's have a look at the SenderBase stats for the 63.251.135.0/24 block:
>
> http://www.spamcop.net/w3m?action=map;mask=65535;net=1073414144;sort=ipsort
>

[snipped]

IMHO ask yourself a few questions:

Is Senderbase is owned by Ironport?

What does Senderbase say about Optinrealbig or any of Scotty's domains?

If you report spam from Roving does it go into the bit bucket just like 
Snotty Scotty's?

We get spam from Roving or I should say we block spam from Roving and have 
for a very long time now. There are many sightings in Google if you search 
other ways and other IP addresses they had or have.

The point is, "many" reputible blocking lists currently block Roving for 
spamming directly. It is only logicical that you shouldn't be in the Bonded 
Sender program while you reside on all those lists for spamming.

-- 

Regards,
Merlyn

A Spamcop advocate
No emails this account is for newsgroups only
People demand freedom of speech to make up for the freedom of thought which 
they avoided


From gospamming at yourdomain.invalid  Tue Jan 11 19:37:19 2005
From: gospamming at yourdomain.invalid (D.Diaz)
Date: Tue Jan 11 14:40:03 2005
Subject: [SC-Help] Re: roving.com spammers stay out of spamcop
References: <cs0tlo$14g$1@news.spamcop.net>
	<Xns95DBBFC891AE3xnddmxn@216.154.195.61> <cs15bh$6h0$1@news.spamcop.net>
Message-ID: <Xns95DBD1C74937Axnddmxn@216.154.195.61>

"Merlyn" <Merlyn@Spamcop.net> wrote in
news:cs15bh$6h0$1@news.spamcop.net: 

> We get spam from Roving or I should say we block spam from Roving and
> have for a very long time now. There are many sightings in Google if
> you search other ways and other IP addresses they had or have.
> 
> The point is, "many" reputible blocking lists currently block Roving
> for spamming directly. It is only logicical that you shouldn't be in
> the Bonded Sender program while you reside on all those lists for
> spamming. 
> 

I agree with you and Mc.  As I said, I'm just pointing out the way the
listing algorithm works; and not trying to argue about its "fairness". 
If they spam, they are spammers; there's no argument there.  

I also noticed that 63.251.135.69 seems to be the only IP address
roving.com has put in the Bonded Sender Program, and they seem to be
spamming mainly from other addresses in their /26 block, trying to keep
that one "clean". 

Now, another question I'm asking myself is... how many of those spams
emanating from the "bonded" IP address have been reported to
abuse@bondedsender.com so they get fined as per BondedSender's policy? 

-- 
Daniel Diaz
SpamCop User
From gospamming at yourdomain.invalid  Tue Jan 11 19:39:28 2005
From: gospamming at yourdomain.invalid (D.Diaz)
Date: Tue Jan 11 14:40:06 2005
Subject: [SC-Help] Re: roving.com spammers stay out of spamcop
References: <cs0tlo$14g$1@news.spamcop.net>
	<Xns95DBBFC891AE3xnddmxn@216.154.195.61> <cs15bh$6h0$1@news.spamcop.net>
	<Xns95DBD1C74937Axnddmxn@216.154.195.61>
Message-ID: <Xns95DBD2243233Cxnddmxn@216.154.195.61>

"D.Diaz" <gospamming@yourdomain.invalid> wrote in 
news:Xns95DBD1C74937Axnddmxn@216.154.195.61:

> I also noticed that 63.251.135.69 seems to be the only IP address
> roving.com has put in the Bonded Sender Program,...
> 

Oops!  Make that 63.251.135.96  :-/

-- 
Daniel Diaz
SpamCop User
From Merlyn at Spamcop.net  Tue Jan 11 14:43:00 2005
From: Merlyn at Spamcop.net (Merlyn)
Date: Tue Jan 11 14:45:03 2005
Subject: [SC-Help] Re: roving.com spammers stay out of spamcop
References: <cs0tlo$14g$1@news.spamcop.net>
	<Xns95DBBFC891AE3xnddmxn@216.154.195.61> <cs15bh$6h0$1@news.spamcop.net>
	<Xns95DBD1C74937Axnddmxn@216.154.195.61>
Message-ID: <cs1a84$a46$1@news.spamcop.net>

"D.Diaz" <gospamming@yourdomain.invalid> wrote in message 
news:Xns95DBD1C74937Axnddmxn@216.154.195.61...
> "Merlyn" <Merlyn@Spamcop.net> wrote in
> news:cs15bh$6h0$1@news.spamcop.net:
>
>> We get spam from Roving or I should say we block spam from Roving and
>> have for a very long time now. There are many sightings in Google if
>> you search other ways and other IP addresses they had or have.
>>
>> The point is, "many" reputible blocking lists currently block Roving
>> for spamming directly. It is only logicical that you shouldn't be in
>> the Bonded Sender program while you reside on all those lists for
>> spamming.
>>
>
> I agree with you and Mc.  As I said, I'm just pointing out the way the
> listing algorithm works; and not trying to argue about its "fairness".
> If they spam, they are spammers; there's no argument there.
>
> I also noticed that 63.251.135.69 seems to be the only IP address
> roving.com has put in the Bonded Sender Program, and they seem to be
> spamming mainly from other addresses in their /26 block, trying to keep
> that one "clean".
>
> Now, another question I'm asking myself is... how many of those spams
> emanating from the "bonded" IP address have been reported to
> abuse@bondedsender.com so they get fined as per BondedSender's policy?
>

Good point, but would they get fined? Only Ironport would know :-)

-- 

Regards,
Merlyn

A Spamcop advocate
No emails this account is for newsgroups only
People demand freedom of speech to make up for the freedom of thought which 
they avoided


From David1 at suescornerweb.com  Tue Jan 11 16:12:48 2005
From: David1 at suescornerweb.com (David 1)
Date: Tue Jan 11 16:15:03 2005
Subject: [SC-Help] No source IP address found, cannot proceed.
Message-ID: <cs1fgm$e3t$1@news.spamcop.net>

tracking link
http://www.spamcop.net/sc?id=z711612709z242993b216947a68d52d24658337d42az


Parsing header:
No source IP address found, cannot proceed.
Add/edit your mailhost configuration
Finding full email headers
Submitting spam via email (may work better)
Example: What spam headers should look like
No tracking information found in header:

X-Account-Key: account2

Probably not full headers - see FAQ:

I've been getting quite a few of these latly & don't understand why, I 
got lucky & just happen to keep this email incase more info is needed.
-- 

David 1
bad addy
spamtrap@suescornerweb.com
From MikeE at ster.invalid  Tue Jan 11 13:23:10 2005
From: MikeE at ster.invalid (Mike Easter)
Date: Tue Jan 11 16:25:02 2005
Subject: [SC-Help] Re: No source IP address found, cannot proceed.
References: <cs1fgm$e3t$1@news.spamcop.net>
Message-ID: <cs1g0s$ek5$1@news.spamcop.net>

David 1 wrote:
www.spamcop.net/sc?id=z711612709z242993b216947a68d52d24658337d42az

> Probably not full headers - see FAQ:

There's some stuff up at the top that is screwing up proper header
construction


X-Account-Key: account2

>From hewmre@mailblocks.com Tue Jan 11 19:40:27 2005


The top line wouldn't matter, because it is proper header field
construction, but the empty line after doesn't work at all in a header,
nor the 2nd text line.

If you get rid of that stuff, it works OK.

www.spamcop.net/sc?id=z711621100zbd3ebb9130a11ac70655daad5431c921z



-- 
Mike Easter
kibitzer, not SC admin

From nobody at spamcop.net  Tue Jan 11 22:40:48 2005
From: nobody at spamcop.net (Doug)
Date: Tue Jan 11 17:45:04 2005
Subject: [SC-Help] hotmail/msn, gmail, et.al.
Message-ID: <Xns95DB9543B5B2Dspamsucksabigone@216.154.195.61>

Long time paid user, but not a sysadim. Over the past several months [since 
retirement], I've been making a concerted effort to send a complaint to 
yahoo each time I see a domain registered with a yahoo address. I had read 
in one of the ng that such usage violates yahoo's TOS. Haven't determined 
whether it's done any good, but I'm just trying to help the cause.

Question is, do hotmail/msn, or gmail, have a similar TOS clause that 
prohibits using their e-mail addys in domain registrations? And if so, does 
anyone have the proper complaint addresses for these?

I tried to get to a TOS page on the hotmail site and you have to have 
javascript enabled and they "push" IE, or Netscape. I don't use js and I'm 
an Opera user so I'm hitting the wall.

Any help appreciated
TIA
-- 
Doug Goodwin
 YMMV

Never let your sense of morals get in the way of doing what's right. 
-- Salvor Hardin
From David1 at suescornerweb.com  Tue Jan 11 18:09:56 2005
From: David1 at suescornerweb.com (David 1)
Date: Tue Jan 11 18:15:05 2005
Subject: [SC-Help] Re: No source IP address found, cannot proceed.
In-Reply-To: <cs1g0s$ek5$1@news.spamcop.net>
References: <cs1fgm$e3t$1@news.spamcop.net> <cs1g0s$ek5$1@news.spamcop.net>
Message-ID: <cs1md9$iif$1@news.spamcop.net>

Mike Easter wrote:
> David 1 wrote:
> www.spamcop.net/sc?id=z711612709z242993b216947a68d52d24658337d42az
> 
> 
>>Probably not full headers - see FAQ:
> 
> 
> There's some stuff up at the top that is screwing up proper header
> construction
> 
> 
> X-Account-Key: account2
> 
>>From hewmre@mailblocks.com Tue Jan 11 19:40:27 2005
> 
> 
> The top line wouldn't matter, because it is proper header field
> construction, but the empty line after doesn't work at all in a header,
> nor the 2nd text line.
> 
> If you get rid of that stuff, it works OK.
> 
> www.spamcop.net/sc?id=z711621100zbd3ebb9130a11ac70655daad5431c921z
> 
> 
> 

ok, is that something the spammers are putting in ????

-- 

David 1
bad addy
spamtrap@suescornerweb.com
From 79ytka802 at sneakemail.com  Tue Jan 11 23:40:34 2005
From: 79ytka802 at sneakemail.com (Aviatrix)
Date: Tue Jan 11 18:45:07 2005
Subject: [SC-Help] Re: hotmail/msn, gmail, et.al.
In-Reply-To: <Xns95DB9543B5B2Dspamsucksabigone@216.154.195.61>
References: <Xns95DB9543B5B2Dspamsucksabigone@216.154.195.61>
Message-ID: <cs1o5d$jr4$1@news.spamcop.net>



Doug wrote:

> Long time paid user, but not a sysadim. Over the past several months [since 
> retirement], I've been making a concerted effort to send a complaint to 
> yahoo each time I see a domain registered with a yahoo address. I had read 
> in one of the ng that such usage violates yahoo's TOS. Haven't determined 
> whether it's done any good, but I'm just trying to help the cause.

Why are you doing this? How do you think it will help any cause?

I have a (little-used) Yahoo account. I'm not aware of any TOS that 
prohibit me from using my Yahoo address in a Whois record. Maybe that 
prohibition didn't exist when I signed up with Yahoo. Maybe it was there 
in the small print but I never noticed it. I have never used my Yahoo 
address for a domain name registration, but I'm sure there are many many 
people out there who put their Yahoo address in their domain name 
registration, in all innocence and in good faith, because they're not 
aware of this bit of small print.

Or are you restricting your reporting activities to domains that have 
been used for spamming? This would make slightly more sense, but I don't 
think it would achieve much... a spammer isn't going to worry about the 
loss of a disposable Yahoo account. In fact I don't even think spammers 
are worried about the loss of a domain any more... domains are far too 
cheap, and I suspect that with the recent free .info domain offers 
spammers will have been stockpiling domains so that the moment they lose 
one they can just use another one.

From MikeE at ster.invalid  Tue Jan 11 17:14:45 2005
From: MikeE at ster.invalid (Mike Easter)
Date: Tue Jan 11 20:15:17 2005
Subject: [SC-Help] Re: No source IP address found, cannot proceed.
References: <cs1fgm$e3t$1@news.spamcop.net> <cs1g0s$ek5$1@news.spamcop.net>
	<cs1md9$iif$1@news.spamcop.net>
Message-ID: <cs1tj4$nh8$1@news.spamcop.net>

David 1 wrote:
> ok, is that something the spammers are putting in ????

Assuming I'm allowed to guess at something, my guess would be 'No.'

My first guess would be the cause was somewhere between mx2.frognet.net
and whatever you handle your mail with.

That guess would be highly suspicious of the thing that stamps these
'good' lines into the header:

Delivered-To: suescornerweb.com-x
Received: (qmail 3494 invoked by uid 700); 11 Jan 2005 19:40:27 -0000

I would suspect that 'thing' or process of stamping 'bad lines' -
non-compliant line or lines - in/on there too.  I would be accusing that
thing/process of stamping/adding everything from the topmost Received
line up, and screwing up the headers in the process.

That the headers were fine when mx2.frognet stamped its Received line,
and then something went wrong.

-- 
Mike Easter
kibitzer, not SC admin

From MikeE at ster.invalid  Tue Jan 11 17:30:20 2005
From: MikeE at ster.invalid (Mike Easter)
Date: Tue Jan 11 20:30:03 2005
Subject: [SC-Help] Re: hotmail/msn, gmail, et.al.
References: <Xns95DB9543B5B2Dspamsucksabigone@216.154.195.61>
	<cs1o5d$jr4$1@news.spamcop.net>
Message-ID: <cs1uga$o4k$1@news.spamcop.net>

Aviatrix wrote:
> Doug wrote:

>> complaint to yahoo each time I see a domain registered with a yahoo
>> address. I had read in one of the ng that such usage violates
>> yahoo's TOS.

> Why are you doing this? How do you think it will help any cause?

The idea would be, if it were true, that /if/ yahoo, hotmail/msn, gmail
had a policy against usage of their /free/ accounts 'commercially';  and
/if/ the account in question /were/ free, which isn't automatic just
because something is a yahoo or hotmail;  and /if/ the provider
terminated the account because the use of the free account was for a
commercial purpose ie as a 'business' to register the domain name;  and
/if/ the domainname registration email address were lost;  /then/ the
domainname registration wouldn't be 'any good', which would/could lead
to loss of the domainname registration.  That would be part of a
strategy for an attack on the domainname registration.

In support of that strategy, some have reported that hotmail, which is
sometimes pretty quick on the trigger against complaints when properly
addressed and documented, has terminated a hotmail account which
facilitated the reporter eventually terminating a domainname
registration.

In light of all of my wherefores and whereas/es and if then/s and
therefores above, you can see that there is a tenuous chain between such
a notification and something actually happening, along with some fuzzy
information in the various TOSes and ambiguity of whether an account is
free or not.  I just looked at gmail's, and it wasn't very convincing to
me that the strategy would likely bear fruit on a TOS basis.

-- 
Mike Easter
kibitzer, not SC admin

From wb8tyw at qsl.network  Tue Jan 11 21:16:28 2005
From: wb8tyw at qsl.network (John E. Malmberg)
Date: Tue Jan 11 21:20:03 2005
Subject: [SC-Help] Re: roving.com spammers stay out of spamcop
In-Reply-To: <cs0u6i$1gl$1@news.spamcop.net>
References: <cs0tlo$14g$1@news.spamcop.net> <cs0u6i$1gl$1@news.spamcop.net>
Message-ID: <cs219s$puo$1@news.spamcop.net>

Merlyn wrote:
> "McWebber" <mcwebber@my-deja.com> wrote in message 
> news:cs0tlo$14g$1@news.spamcop.net...
> 
>>What is the deal with Spamcop and roving.com? It seems they are listed
>>everywhere except Spamcop. I find it hard to believe since my spamtraps, 
>>and  ...

<snip>
> 
> Spamhause recently re-added them:

Once an I.P. address is in any spamhaus.org list, many of spamcop 
reporters no longer see any spam from them to report.

And if they are a prolific enough spammer, they may have already earned 
a permanent local block before spamhaus.org got around to listing them.

According to one of my postmasters, about 50% of the spam delivery 
attempts is blocked by the local block list.

 From the same statistics, it looks like most spammers realize that 
anything listed in sbl.spamhaus.org is useless for sending e-mail to 
most of the internet.

Some of them also seem to have realized the same thing about I.P. 
addresses in the SORBS DUHL list.

-John
wb8tyw@qsl.network
Personal Opinion Only
From David1 at suescornerweb.com  Tue Jan 11 21:21:48 2005
From: David1 at suescornerweb.com (David 1)
Date: Tue Jan 11 21:20:07 2005
Subject: [SC-Help] Re: No source IP address found, cannot proceed.
In-Reply-To: <cs1tj4$nh8$1@news.spamcop.net>
References: <cs1fgm$e3t$1@news.spamcop.net> <cs1g0s$ek5$1@news.spamcop.net>
	<cs1md9$iif$1@news.spamcop.net> <cs1tj4$nh8$1@news.spamcop.net>
Message-ID: <cs21gc$pul$1@news.spamcop.net>

Mike Easter wrote:
> David 1 wrote:
> 
>>ok, is that something the spammers are putting in ????
> 
> 
> Assuming I'm allowed to guess at something, my guess would be 'No.'
> 
> My first guess would be the cause was somewhere between mx2.frognet.net
> and whatever you handle your mail with.
> 
> That guess would be highly suspicious of the thing that stamps these
> 'good' lines into the header:
> 
> Delivered-To: suescornerweb.com-x
> Received: (qmail 3494 invoked by uid 700); 11 Jan 2005 19:40:27 -0000
> 
> I would suspect that 'thing' or process of stamping 'bad lines' -
> non-compliant line or lines - in/on there too.  I would be accusing that
> thing/process of stamping/adding everything from the topmost Received
> line up, and screwing up the headers in the process.
> 
> That the headers were fine when mx2.frognet stamped its Received line,
> and then something went wrong.
> 

ok, thank ya now I know where to go

-- 

David 1
bad addy
spamtrap@suescornerweb.com
From mcwebber at my-deja.com  Wed Jan 12 02:56:13 2005
From: mcwebber at my-deja.com (McWebber)
Date: Wed Jan 12 02:55:07 2005
Subject: [SC-Help] Re: roving.com spammers stay out of spamcop
References: <cs0tlo$14g$1@news.spamcop.net>
	<Xns95DBBFC891AE3xnddmxn@216.154.195.61> <cs15bh$6h0$1@news.spamcop.net>
	<Xns95DBD1C74937Axnddmxn@216.154.195.61>
Message-ID: <cs2l3i$619$1@news.spamcop.net>

"D.Diaz" <gospamming@yourdomain.invalid> wrote in message
news:Xns95DBD1C74937Axnddmxn@216.154.195.61...
>
> Now, another question I'm asking myself is... how many of those spams
> emanating from the "bonded" IP address have been reported to
> abuse@bondedsender.com so they get fined as per BondedSender's policy?
>

Wanna bet you just get unsubscribed if you send them an unmunged report? As
far as the lack of NANAS reports go, it's a little hard to report blocked
spam.

[root mail]# grep roving /var/log/maillog
Jan 11 06:57:31 admin sendmail[431]: j0BCvQY00431: ruleset=check_relay,
arg1=ccm01.roving.com, arg2=63.251.135.74, relay=ccm01.roving.com
[63.251.135.74], reject=550 5.0.0 fuck off spammer
Jan 11 10:32:49 admin sendmail[23421]: j0BGWiY23421: ruleset=check_relay,
arg1=ccm09.roving.com, arg2=63.251.135.115, relay=ccm09.roving.com
[63.251.135.115], reject=550 5.0.0 fuck off spammer
Jan 11 12:28:28 admin sendmail[5727]: j0BISNY05727: ruleset=check_relay,
arg1=mailface.roving.com, arg2=63.251.135.75, relay=mailface.roving.com
[63.251.135.75], reject=550 5.0.0 fuck off spammer
Jan 11 15:59:41 admin sendmail[869]: j0BLxaY00869: ruleset=check_relay,
arg1=ccm01.roving.com, arg2=63.251.135.74, relay=ccm01.roving.com
[63.251.135.74], reject=550 5.0.0 fuck off spammer
Jan 11 17:27:21 admin sendmail[11745]: j0BNRGY11745: ruleset=check_relay,
arg1=mailface.roving.com, arg2=63.251.135.75, relay=mailface.roving.com
[63.251.135.75], reject=550 5.0.0 fuck off spammer

It goes like that every day. They ignore rejections and just keep sending
despite hard bounces.

-- 
McWebber
"Richter points to the lack of legal action against his company as proof
that he's operating appropriately."
Information Week, November 10, 2003


From MikeE at ster.invalid  Wed Jan 12 04:34:05 2005
From: MikeE at ster.invalid (Mike Easter)
Date: Wed Jan 12 07:35:15 2005
Subject: [SC-Help] Re: Getting balcklisted
References: <cs2o2s$87g$1@news.spamcop.net>
Message-ID: <cs35cr$f91$1@news.spamcop.net>

Posted to .help and .spam;  f/ups to .help -- so as to 'move' the
discussion to .help, see below.

Iain wrote:
> I hope this is the correct group to post this to...
>
> I am working with a large Government Department who want to send Email
> reminders to users of their online services. There's a lot of concern
> about users giving incorrect addresses (either deliberately or by
> mistake) and this leading to undeliverable mail and this being
> mis-identified by ISPs as spam and the Department being blacklisted.
>
> Personally I think the chances of this are very low, but does anyone
> have any general ideas on what might cause an ISP to automatically
> blacklist an IP address? There have been claims that "as few as three
> misaddressed Emails to AOL" can cause AOL to block an IP but that
> doesn't seem to be included in AOL's spam policies and would surely
> result in most SMTP servers in the work being blacklisted by AOL!
>
> Pointers to resources such as AOL's policy would be helpful plus any
> ideas, views or opinions. It would be intended that every message
> would have a 'This message is not relevant to me/unsubscribe' link
> plus of course full rDNS etc. would all work.
>
> Thanks.../Iain


The faq for the purposes of the various newsgroups is misleading and
neglected, and no one reads in or uses spamcop.spam, because .spam is
only for posting raw spam which is not allowed in .help or spamcop.  The
proper display of raw spam is to use a tracking url, not to use this
group whose purpose arose before the tracking url could display an
entire raw spam.

.help and spamcop are for asking general questions relating to spam and
spamcop, and no raw spam is allowed in those groups, hence the need for
this group to post the raw spam being discussed in the other groups.  No
one reads .spam because there is supposed to be only spam in it.

-- 
Mike Easter
kibitzer, not SC admin

From MikeE at ster.invalid  Wed Jan 12 04:51:14 2005
From: MikeE at ster.invalid (Mike Easter)
Date: Wed Jan 12 07:50:03 2005
Subject: [SC-Help] Re: Getting balcklisted
References: <cs2o2s$87g$1@news.spamcop.net> <cs35cr$f91$1@news.spamcop.net>
Message-ID: <cs36d0$ftq$1@news.spamcop.net>

> Iain wrote:
>> I hope this is the correct group to post this to...

spamcop or .help will be fine now.

>> I am working with a large Government Department who want to send
>> Email reminders to users of their online services. There's a lot of
>> concern about users giving incorrect addresses (either deliberately
>> or by mistake) and this leading to undeliverable mail and this being
>> mis-identified by ISPs as spam and the Department being blacklisted.

There are many many reasons to be using good list management.  Failure
to use good mailing list management will lead to the list's mail being
reported as spam;  such spamsources will be listed and blocked;  then
the listed won't be getting the mail they want.  And the IP address
won't be able to complete its regular mail to other mail recipients not
on the mailing list.  Bad business all around.

>> Personally I think the chances of this are very low, but does anyone
>> have any general ideas on what might cause an ISP to automatically
>> blacklist an IP address?

There are many many scores of blocklists, over 150, devised by various
means and used in various ways.  Providers use public blocklists and
create their own blocklists as part of a comprehensive strategy against
spam, which is a big big problem.

>> There have been claims that "as few as three
>> misaddressed Emails to AOL" can cause AOL to block an IP but that
>> doesn't seem to be included in AOL's spam policies and would surely
>> result in most SMTP servers in the work being blacklisted by AOL!

I'm not privvy to how AOL does its blocking, but it is an adamant
antispam place, so sending multiple unwanted mails to them would be a
very bad idea.  I've seen blocked mail reports from AOL.  They block
individual IPs, they block domains, they block lots of things.

>> Pointers to resources such as AOL's policy would be helpful plus any
>> ideas, views or opinions. It would be intended that every message
>> would have a 'This message is not relevant to me/unsubscribe' link
>> plus of course full rDNS etc. would all work.

Nope;  having bad mailing list management cannot be solved by having
unsub information.  The only people who should ever use unsub
information is a person who subscribed in the first place.  You cannot
send unwanted mail to someone or to a spamtrap and expect it to unsub.
That mail will be reported as spam, you can't unsub the reporter or the
spamtrap, and you will get listed and your mail blocked.

You have to not send anyone mail which wasn't specifically requested by
them, and from you and for the specific purpose of the list;  not some
other purpose of some other list;  and which request was confirmed
verifiably by a unique token.

There are guidelines for the creating and management of mailing lists.
Here's one http://www.mail-abuse.com/an_listmgntgdlines.html Guidelines
for proper mailing list management


-- 
Mike Easter
kibitzer, not SC admin

From ipmarketing at spamcop.net  Wed Jan 12 15:21:45 2005
From: ipmarketing at spamcop.net (Iain)
Date: Wed Jan 12 10:25:03 2005
Subject: [SC-Help] Re: Getting balcklisted
References: <cs2o2s$87g$1@news.spamcop.net> <cs35cr$f91$1@news.spamcop.net>
	<cs36d0$ftq$1@news.spamcop.net>
Message-ID: <cs3fab$l7e$1@news.spamcop.net>

Thanks for this Mike, for the reference link and for posting this across to 
spamcop.help...but to explain a bit more...

First, the plans are only that Email will be sent to addresses which users 
have explicitly provided and only content related to services they've 
opted-in to receive will be sent to them. There's no 'buying of lists' or 
anything like that. It's all about proper informed opt-in, so let's take all 
that as accepted. The issue comes down to what is *really* meant by; 
"confirmed verifiably by a unique token." So...

A user comes to the Government site. They login with credentials which can 
be used to identify them as a real-life identity, i.e. a degree of identity 
verifcation *far* beyond that behind most list management systems. They ask 
to be sent information by Email. It's then the degree of verification of the 
Email address they provide being shown to belong to that user. So there's 
options...

1. You send a welcome message (as advised when they signed up) confirming 
their set-up of Email information and including an unsubscribe link for 
one-click removal if for some reason they want to cancel the subscription. 
The idea here is that if the address is someone elses, that someone else has 
a fast way of saying; "This is nothing to do with me. I don't want to 
receive any information." This is the best we can do at this point.

2. If the user inadvertently enters someone elses address, i.e. a valid 
address but not their own, then the incorrect recipient would have an 
immediate 'get me out of this' link as described. If the incorrect chose not 
to immediately unsubscribe then they implcitly agree to receive further 
mail. That's what the welcome would say and would advise they immediately 
use the "This has come to the wrong person" link if they didn't want to 
continue to receive mail. In addition every message sent subsequently would 
include such a "No more mail" link. Again, this is the best we can do to 
allow someone to remove their address.

3. If the user gives us a completely wrong address or an address which goes 
to some SMTP sink, then it's hard for us to know that other than through 
parsing any reply back from the recipient ISP. Obviously the 'unsubscribe' 
link can't be clicked, but I don't see how we can realistically do anything 
but send a welcome message to the address the user gives us. Or do you think 
differently??

4. Now point 3 above makes the case for requiring a positive; "Yes thank you 
for the welcome Email and I confirm I want to continue receiving it" reply. 
This would prevent a second Email being sent to the same address if say it 
was some kind of sink (and so no bounce/non-delivery report would come back) 
unless the positive reply had been received. However, two issues:

4a. Although we can collect a positive confirmation 'by a unique token' it 
doesn't actually tell us that the person making that positive confirmation 
is the same person who gave us the address. They could have given us a 
correct address for some other person and that other person, for whatever 
reason, clicked the 'I want to confirm my Opt-in' link. So we have a 
positive opt-in, but not from the right person

4b. We could ensure that the confirmation was from the right person by 
making the person log back into the web service to make their confirmation. 
This ensures that the person who set up the Email also has access to the 
'unique token' sent in the welcome message. So this is a high degree of 
verification, but also a high degree of nuisance for the user and our 
business manager's want to make the Email sign-up simple and quick and not 
to require re logins

4c. Even if we go through either a 'weak' verification (4a) or strong 
verification (4b) exercise of confirming the Email address and opt-in 
status, the Email address could at any point in time be deleted, suspended 
or otherwise become invalid without us knowing. At that point we would 
(unknowingly) continue to send Email to the positiviely verified address but 
which was no longer valid. At that point we're pretty much in the same 
position as at point 2 in that we'd be sending Email to an ISP to an address 
that didn't exist/was invalid. So, if sending mail to invalid addresses is 
liable to get the sending domain blacklisted, then we're just as lilkely to 
be blacklisted at this point as we are at point 2. That then begs the 
question, what do we gain from the verification steps as the verification is 
only at a point in time and the address may become invalid for any number of 
reasons at any time and so we're into sending mail to non-existant mail 
addresses

What I am therefore trying to work through - and I'm readin various other 
sources but thought I'd ask here - is what is 'best practice' and what 
ensure the department won't end up being blacklisted either due to 
deliberate action by someone (deliberately giving false mail addresses) or 
due to accidental input of an Email address or through an Email address 
lapsing/becoming invalid at some point after being verified.

Hope this makes sense. Also, BTW, AOL go through their spam policy in a lot 
of detail at http://www.aol.co.uk/about/policy/spam/senderfaq.html and 
linked pages :-)

Thanks.../Iain


"Mike Easter" <MikeE@ster.invalid> wrote in message 
news:cs36d0$ftq$1@news.spamcop.net...
>> Iain wrote:
>>> I hope this is the correct group to post this to...
>
> spamcop or .help will be fine now.
>
>>> I am working with a large Government Department who want to send
>>> Email reminders to users of their online services. There's a lot of
>>> concern about users giving incorrect addresses (either deliberately
>>> or by mistake) and this leading to undeliverable mail and this being
>>> mis-identified by ISPs as spam and the Department being blacklisted.
>
> There are many many reasons to be using good list management.  Failure
> to use good mailing list management will lead to the list's mail being
> reported as spam;  such spamsources will be listed and blocked;  then
> the listed won't be getting the mail they want.  And the IP address
> won't be able to complete its regular mail to other mail recipients not
> on the mailing list.  Bad business all around.
>
>>> Personally I think the chances of this are very low, but does anyone
>>> have any general ideas on what might cause an ISP to automatically
>>> blacklist an IP address?
>
> There are many many scores of blocklists, over 150, devised by various
> means and used in various ways.  Providers use public blocklists and
> create their own blocklists as part of a comprehensive strategy against
> spam, which is a big big problem.
>
>>> There have been claims that "as few as three
>>> misaddressed Emails to AOL" can cause AOL to block an IP but that
>>> doesn't seem to be included in AOL's spam policies and would surely
>>> result in most SMTP servers in the work being blacklisted by AOL!
>
> I'm not privvy to how AOL does its blocking, but it is an adamant
> antispam place, so sending multiple unwanted mails to them would be a
> very bad idea.  I've seen blocked mail reports from AOL.  They block
> individual IPs, they block domains, they block lots of things.
>
>>> Pointers to resources such as AOL's policy would be helpful plus any
>>> ideas, views or opinions. It would be intended that every message
>>> would have a 'This message is not relevant to me/unsubscribe' link
>>> plus of course full rDNS etc. would all work.
>
> Nope;  having bad mailing list management cannot be solved by having
> unsub information.  The only people who should ever use unsub
> information is a person who subscribed in the first place.  You cannot
> send unwanted mail to someone or to a spamtrap and expect it to unsub.
> That mail will be reported as spam, you can't unsub the reporter or the
> spamtrap, and you will get listed and your mail blocked.
>
> You have to not send anyone mail which wasn't specifically requested by
> them, and from you and for the specific purpose of the list;  not some
> other purpose of some other list;  and which request was confirmed
> verifiably by a unique token.
>
> There are guidelines for the creating and management of mailing lists.
> Here's one http://www.mail-abuse.com/an_listmgntgdlines.html Guidelines
> for proper mailing list management
>
>
> -- 
> Mike Easter
> kibitzer, not SC admin
> 


From dkona7b02 at sneakemail.com  Wed Jan 12 10:58:13 2005
From: dkona7b02 at sneakemail.com (Spam Hater)
Date: Wed Jan 12 10:58:17 2005
Subject: [SC-Help] Re: Getting balcklisted
In-Reply-To: <cs3fab$l7e$1@news.spamcop.net>
References: <cs2o2s$87g$1@news.spamcop.net> <cs35cr$f91$1@news.spamcop.net>
 <cs36d0$ftq$1@news.spamcop.net>
Message-ID: <3.0.5.32.20050112105813.014c28a8@loki.fstrf.org>

Please see my remarks in line with yours...

At 03:21 PM 1/12/2005 +0000, Iain typed:
 
>Thanks for this Mike, for the reference link and for posting this across to 
>spamcop.help...but to explain a bit more...

I'm not Mike, but I'll jump in with my opinions anyway...  :)

>First, the plans are only that Email will be sent to addresses which users 
>have explicitly provided and only content related to services they've 
>opted-in to receive will be sent to them. There's no 'buying of lists' or 
>anything like that. It's all about proper informed opt-in, so let's take all 
>that as accepted. The issue comes down to what is *really* meant by; 
>"confirmed verifiably by a unique token." So...
>
>A user comes to the Government site. They login with credentials which can 
>be used to identify them as a real-life identity, i.e. a degree of identity 
>verifcation *far* beyond that behind most list management systems. They ask 
>to be sent information by Email. It's then the degree of verification of the 
>Email address they provide being shown to belong to that user. So there's 
>options...
>
>1. You send a welcome message (as advised when they signed up) confirming 
>their set-up of Email information and including an unsubscribe link for 
>one-click removal if for some reason they want to cancel the subscription. 
>The idea here is that if the address is someone elses, that someone else has 
>a fast way of saying; "This is nothing to do with me. I don't want to 
>receive any information." This is the best we can do at this point.

Bzzzzt, wrong answer...  If this is the best you can do, you are setting yourself
up to be listed as a SPAM source!  People are routinely advised NOT to
click unsubscribe links in messages they receive.  This is a quick way to 
confirm your account to the SPAMmers who then sell it for more money...

>2. If the user inadvertently enters someone elses address, i.e. a valid 
>address but not their own, then the incorrect recipient would have an 
>immediate 'get me out of this' link as described. If the incorrect chose not 
>to immediately unsubscribe then they implcitly agree to receive further 
>mail. That's what the welcome would say and would advise they immediately 
>use the "This has come to the wrong person" link if they didn't want to 
>continue to receive mail. In addition every message sent subsequently would 
>include such a "No more mail" link. Again, this is the best we can do to 
>allow someone to remove their address.

Again, no user should ever click a 'get me out of this' link so you are still
going to get reported as SPAM.

>3. If the user gives us a completely wrong address or an address which goes 
>to some SMTP sink, then it's hard for us to know that other than through 
>parsing any reply back from the recipient ISP. Obviously the 'unsubscribe' 
>link can't be clicked, but I don't see how we can realistically do anything 
>but send a welcome message to the address the user gives us. Or do you think 
>differently??

Same difference as above.  Whether it is going to an "SMTP sink" or a live
person who has never heard of you before, neither of them is going to click
your unsubscribe link and you may very well get reported.  Especially if the
wrong address the provided happens to be a SpamTrap address that gets
reported automatically.

>4. Now point 3 above makes the case for requiring a positive; "Yes thank you 
>for the welcome Email and I confirm I want to continue receiving it" reply. 
>This would prevent a second Email being sent to the same address if say it 
>was some kind of sink (and so no bounce/non-delivery report would come back) 
>unless the positive reply had been received. However, two issues:

Stop right there!!  This is the only way to play!  You still may get reported by
those with a hair trigger who have no idea who you are and figure it is just
run of the mill SPAM, but this is your best bet for staying off the SPAMlists.

>4a. Although we can collect a positive confirmation 'by a unique token' it 
>doesn't actually tell us that the person making that positive confirmation 
>is the same person who gave us the address. They could have given us a 
>correct address for some other person and that other person, for whatever 
>reason, clicked the 'I want to confirm my Opt-in' link. So we have a 
>positive opt-in, but not from the right person

Correct.

>4b. We could ensure that the confirmation was from the right person by 
>making the person log back into the web service to make their confirmation. 
>This ensures that the person who set up the Email also has access to the 
>'unique token' sent in the welcome message. So this is a high degree of 
>verification, but also a high degree of nuisance for the user and our 
>business manager's want to make the Email sign-up simple and quick and not 
>to require re logins

If you want to be 100% certain that the email address belongs to the person
that signed up, you have no other choice.  Tell your business manager to wake
up and smell the SPAM frying...  I have joined several mailing lists that
operate in this fashion and it is not a hassle at all.  If I really want the info I
am willing to jump through a reasonable number of hoops to get it.

>4c. Even if we go through either a 'weak' verification (4a) or strong 
>verification (4b) exercise of confirming the Email address and opt-in 
>status, the Email address could at any point in time be deleted, suspended 
>or otherwise become invalid without us knowing. At that point we would 
>(unknowingly) continue to send Email to the positiviely verified address but 
>which was no longer valid. At that point we're pretty much in the same 
>position as at point 2 in that we'd be sending Email to an ISP to an address 
>that didn't exist/was invalid. So, if sending mail to invalid addresses is 
>liable to get the sending domain blacklisted, then we're just as lilkely to 
>be blacklisted at this point as we are at point 2. That then begs the 
>question, what do we gain from the verification steps as the verification is 
>only at a point in time and the address may become invalid for any number of 
>reasons at any time and so we're into sending mail to non-existant mail 
>addresses

This is less likely to happen and if it does, you can easily provide the
original signup details and show that you had been sending email to that
address for N number of months successfully and without complaint.  This 
would be enough to get you off of any SPAMlists.  A preemptive approach
would be to re-verify your lists every so often with the same confirmed opt-in
approach.

>What I am therefore trying to work through - and I'm readin various other 
>sources but thought I'd ask here - is what is 'best practice' and what 
>ensure the department won't end up being blacklisted either due to 
>deliberate action by someone (deliberately giving false mail addresses) or 
>due to accidental input of an Email address or through an Email address 
>lapsing/becoming invalid at some point after being verified.

4b is best practice and if you follow it, you should not have many problems.

>Hope this makes sense. Also, BTW, AOL go through their spam policy in a lot 
>of detail at http://www.aol.co.uk/about/policy/spam/senderfaq.html and 
>linked pages :-)
>
>Thanks.../Iain

You are welcome.
From MikeE at ster.invalid  Wed Jan 12 08:00:21 2005
From: MikeE at ster.invalid (Mike Easter)
Date: Wed Jan 12 11:00:03 2005
Subject: [SC-Help] Re: Getting balcklisted
References: <cs2o2s$87g$1@news.spamcop.net> <cs35cr$f91$1@news.spamcop.net>
	<cs36d0$ftq$1@news.spamcop.net> <cs3fab$l7e$1@news.spamcop.net>
Message-ID: <cs3hfj$mpv$1@news.spamcop.net>

Iain wrote:
> It's all about proper informed
> opt-in, so let's take all that as accepted.

We'll see.

> 1. You send a welcome message (as advised when they signed up)
> confirming their set-up of Email information and including an
> unsubscribe link for one-click removal if for some reason they want
> to cancel the subscription.

No.  That is opt-out.  We're looking for/ discussing/ confirmation of
having subscribed.  They shouldn't be subscribed until they have
properly confirmed that they have subscribed.

>  The idea here is that if the address is
> someone elses, that someone else has a fast way of saying; "This is
> nothing to do with me. I don't want to receive any information." This
> is the best we can do at this point.

Nope.  That's not good enough.  If I 'accidentally' receive some mailing
from someone, it isn't my job to unsubscribe.  A great many reporters
will always report that as spam and not unsub.

> 2. If the user inadvertently enters someone elses address, i.e. a
> valid address but not their own, then the incorrect recipient would
> have an immediate 'get me out of this' link as described.

Nope.  That doesn't work.  I don't think you read the link I gave you.

> If the
> incorrect chose not to immediately unsubscribe then they implcitly
> agree to receive further mail.

Nope.  No good.  That kind of list management is going to kill your
dirty list.

> That's what the welcome would say and
> would advise they immediately use the "This has come to the wrong
> person" link if they didn't want to continue to receive mail. In
> addition every message sent subsequently would include such a "No
> more mail" link. Again, this is the best we can do to allow someone
> to remove their address.

Nope.  No good.  You keep saying 'this is the best we can do' when that
is no where near good enough.  I smell a dirty list.

> 3. If the user gives us a completely wrong address or an address
> which goes to some SMTP sink, then it's hard for us to know that
> other than through parsing any reply back from the recipient ISP.
> Obviously the 'unsubscribe' link can't be clicked, but I don't see
> how we can realistically do anything but send a welcome message to
> the address the user gives us. Or do you think differently??

Yes.  I think completely differently.  We aren't even on the same page
because you are using euphemisms which mean exactly the opposite of
their language.  You are using the word 'welcome' to indicate a demand
that some unwilling recipient is supposed to opt-out of getting any more
of something they never wanted.  That's like calling a spam a 'welcome
to my spam' message.

> 4. Now point 3 above makes the case for requiring a positive; "Yes
> thank you for the welcome Email and I confirm I want to continue
> receiving it" reply. This would prevent a second Email being sent to
> the same address if say it was some kind of sink (and so no
> bounce/non-delivery report would come back) unless the positive reply
> had been received. However, two issues:

The confirmation mail when someone first subscribes to something must
contain no 'content' other than its own confirmation.

> 4a. Although we can collect a positive confirmation 'by a unique
> token' it doesn't actually tell us that the person making that
> positive confirmation is the same person who gave us the address.

It does if it is performed correctly.  This is about email and an email
address.  The confirmatory email is sent which requests the
confirmation.  If the confirmation isn't received, the person isn't
subscribed and they get nothing else.  That is confirming the
subscription by opting in, not out.

> They could have given us a correct address for some other person and
> that other person, for whatever reason, clicked the 'I want to
> confirm my Opt-in' link. So we have a positive opt-in, but not from
> the right person

I was speaking of emailing the confirmation.  If a person is sent a
confirmation and they confirm, they are subscribed.  Your imagining that
someone is going to optin to something they didn't want is far-fetched.

> 4b. We could ensure that the confirmation was from the right person by
> making the person log back into the web service to make their
> confirmation. This ensures that the person who set up the Email also
> has access to the 'unique token' sent in the welcome message. So this
> is a high degree of verification, but also a high degree of nuisance
> for the user and our business manager's want to make the Email
> sign-up simple and quick and not to require re logins

You can do it with a unique web login or you can do it with a unique
email reply.  It can be done properly either way.

> 4c. Even if we go through either a 'weak' verification (4a) or strong
> verification (4b) exercise of confirming the Email address and opt-in
> status, the Email address could at any point in time be deleted,
> suspended or otherwise become invalid without us knowing. At that
> point we would (unknowingly) continue to send Email to the
> positiviely verified address but which was no longer valid.

There's also the issue of how to handle bounces for 'no longer valid'.

> At that
> point we're pretty much in the same position as at point 2 in that
> we'd be sending Email to an ISP to an address that didn't exist/was
> invalid. So, if sending mail to invalid addresses is liable to get
> the sending domain blacklisted, then we're just as lilkely to be
> blacklisted at this point as we are at point 2. That then begs the
> question, what do we gain from the verification steps as the
> verification is only at a point in time and the address may become
> invalid for any number of reasons at any time and so we're into
> sending mail to non-existant mail addresses

That sounds like some kind of lame excuse for the problems described at
the top.  Your top part is a much bigger problem than this bottom part.

> What I am therefore trying to work through - and I'm readin various
> other sources but thought I'd ask here - is what is 'best practice'
> and what ensure the department won't end up being blacklisted either
> due to deliberate action by someone (deliberately giving false mail
> addresses) or due to accidental input of an Email address or through
> an Email address lapsing/becoming invalid at some point after being
> verified.

-- 
Mike Easter
kibitzer, not SC admin

From ipmarketing at spamcop.net  Wed Jan 12 16:11:24 2005
From: ipmarketing at spamcop.net (Iain)
Date: Wed Jan 12 11:15:03 2005
Subject: [SC-Help] Re: Getting balcklisted
References: <cs2o2s$87g$1@news.spamcop.net> <cs35cr$f91$1@news.spamcop.net>
	<cs36d0$ftq$1@news.spamcop.net>
	<mailman.61.1105545498.4572.spamcop-help@news.spamcop.net>
Message-ID: <cs3i7e$nio$1@news.spamcop.net>

Well thanks for the thoughts. It's useful to get a number of views, hence 
why explaining the logic so all can comment.

Obviously there is no way to not send the first welcome message and this may 
go to the wrong person.

One of the concerns with the 'positive id verification' 4b solution, i.e. 
verification behind login, is that although it gives positive assusrance 
that both the mail was receive properly *and by the right person* (or at 
least someone with access the the login credentials), it also starts to run 
into phishing concerns. Sending people Email links to log into banking/tax 
services is another concern. So in the same way you say people will never 
click an unsubscribe link (you'd not click an unsubsctibe link going to 
www.irs.gov? - not that this is for the IRS, but you get my point?) then 
people might also not follow-through on an Email link that results in them 
being asked for their login credentials!

There are ways to mitigate the phishing risk (which I'll not go into here), 
but my point is, the 'obvious' best practice from an anti-spam point of view 
may not be the 'best practice' from an anti-phishing perspective. So it's 
all a balance...hence the churning of thoughts :-)

Thanks for your input.../Iain


"Spam Hater" <dkona7b02@sneakemail.com> wrote in message 
news:mailman.61.1105545498.4572.spamcop-help@news.spamcop.net...
> Please see my remarks in line with yours...
>
> At 03:21 PM 1/12/2005 +0000, Iain typed:
>
>>Thanks for this Mike, for the reference link and for posting this across 
>>to
>>spamcop.help...but to explain a bit more...
>
> I'm not Mike, but I'll jump in with my opinions anyway...  :)
>
>>First, the plans are only that Email will be sent to addresses which users
>>have explicitly provided and only content related to services they've
>>opted-in to receive will be sent to them. There's no 'buying of lists' or
>>anything like that. It's all about proper informed opt-in, so let's take 
>>all
>>that as accepted. The issue comes down to what is *really* meant by;
>>"confirmed verifiably by a unique token." So...
>>
>>A user comes to the Government site. They login with credentials which can
>>be used to identify them as a real-life identity, i.e. a degree of 
>>identity
>>verifcation *far* beyond that behind most list management systems. They 
>>ask
>>to be sent information by Email. It's then the degree of verification of 
>>the
>>Email address they provide being shown to belong to that user. So there's
>>options...
>>
>>1. You send a welcome message (as advised when they signed up) confirming
>>their set-up of Email information and including an unsubscribe link for
>>one-click removal if for some reason they want to cancel the subscription.
>>The idea here is that if the address is someone elses, that someone else 
>>has
>>a fast way of saying; "This is nothing to do with me. I don't want to
>>receive any information." This is the best we can do at this point.
>
> Bzzzzt, wrong answer...  If this is the best you can do, you are setting 
> yourself
> up to be listed as a SPAM source!  People are routinely advised NOT to
> click unsubscribe links in messages they receive.  This is a quick way to
> confirm your account to the SPAMmers who then sell it for more money...
>
>>2. If the user inadvertently enters someone elses address, i.e. a valid
>>address but not their own, then the incorrect recipient would have an
>>immediate 'get me out of this' link as described. If the incorrect chose 
>>not
>>to immediately unsubscribe then they implcitly agree to receive further
>>mail. That's what the welcome would say and would advise they immediately
>>use the "This has come to the wrong person" link if they didn't want to
>>continue to receive mail. In addition every message sent subsequently 
>>would
>>include such a "No more mail" link. Again, this is the best we can do to
>>allow someone to remove their address.
>
> Again, no user should ever click a 'get me out of this' link so you are 
> still
> going to get reported as SPAM.
>
>>3. If the user gives us a completely wrong address or an address which 
>>goes
>>to some SMTP sink, then it's hard for us to know that other than through
>>parsing any reply back from the recipient ISP. Obviously the 'unsubscribe'
>>link can't be clicked, but I don't see how we can realistically do 
>>anything
>>but send a welcome message to the address the user gives us. Or do you 
>>think
>>differently??
>
> Same difference as above.  Whether it is going to an "SMTP sink" or a live
> person who has never heard of you before, neither of them is going to 
> click
> your unsubscribe link and you may very well get reported.  Especially if 
> the
> wrong address the provided happens to be a SpamTrap address that gets
> reported automatically.
>
>>4. Now point 3 above makes the case for requiring a positive; "Yes thank 
>>you
>>for the welcome Email and I confirm I want to continue receiving it" 
>>reply.
>>This would prevent a second Email being sent to the same address if say it
>>was some kind of sink (and so no bounce/non-delivery report would come 
>>back)
>>unless the positive reply had been received. However, two issues:
>
> Stop right there!!  This is the only way to play!  You still may get 
> reported by
> those with a hair trigger who have no idea who you are and figure it is 
> just
> run of the mill SPAM, but this is your best bet for staying off the 
> SPAMlists.
>
>>4a. Although we can collect a positive confirmation 'by a unique token' it
>>doesn't actually tell us that the person making that positive confirmation
>>is the same person who gave us the address. They could have given us a
>>correct address for some other person and that other person, for whatever
>>reason, clicked the 'I want to confirm my Opt-in' link. So we have a
>>positive opt-in, but not from the right person
>
> Correct.
>
>>4b. We could ensure that the confirmation was from the right person by
>>making the person log back into the web service to make their 
>>confirmation.
>>This ensures that the person who set up the Email also has access to the
>>'unique token' sent in the welcome message. So this is a high degree of
>>verification, but also a high degree of nuisance for the user and our
>>business manager's want to make the Email sign-up simple and quick and not
>>to require re logins
>
> If you want to be 100% certain that the email address belongs to the 
> person
> that signed up, you have no other choice.  Tell your business manager to 
> wake
> up and smell the SPAM frying...  I have joined several mailing lists that
> operate in this fashion and it is not a hassle at all.  If I really want 
> the info I
> am willing to jump through a reasonable number of hoops to get it.
>
>>4c. Even if we go through either a 'weak' verification (4a) or strong
>>verification (4b) exercise of confirming the Email address and opt-in
>>status, the Email address could at any point in time be deleted, suspended
>>or otherwise become invalid without us knowing. At that point we would
>>(unknowingly) continue to send Email to the positiviely verified address 
>>but
>>which was no longer valid. At that point we're pretty much in the same
>>position as at point 2 in that we'd be sending Email to an ISP to an 
>>address
>>that didn't exist/was invalid. So, if sending mail to invalid addresses is
>>liable to get the sending domain blacklisted, then we're just as lilkely 
>>to
>>be blacklisted at this point as we are at point 2. That then begs the
>>question, what do we gain from the verification steps as the verification 
>>is
>>only at a point in time and the address may become invalid for any number 
>>of
>>reasons at any time and so we're into sending mail to non-existant mail
>>addresses
>
> This is less likely to happen and if it does, you can easily provide the
> original signup details and show that you had been sending email to that
> address for N number of months successfully and without complaint.  This
> would be enough to get you off of any SPAMlists.  A preemptive approach
> would be to re-verify your lists every so often with the same confirmed 
> opt-in
> approach.
>
>>What I am therefore trying to work through - and I'm readin various other
>>sources but thought I'd ask here - is what is 'best practice' and what
>>ensure the department won't end up being blacklisted either due to
>>deliberate action by someone (deliberately giving false mail addresses) or
>>due to accidental input of an Email address or through an Email address
>>lapsing/becoming invalid at some point after being verified.
>
> 4b is best practice and if you follow it, you should not have many 
> problems.
>
>>Hope this makes sense. Also, BTW, AOL go through their spam policy in a 
>>lot
>>of detail at http://www.aol.co.uk/about/policy/spam/senderfaq.html and
>>linked pages :-)
>>
>>Thanks.../Iain
>
> You are welcome. 


From MikeE at ster.invalid  Wed Jan 12 08:28:43 2005
From: MikeE at ster.invalid (Mike Easter)
Date: Wed Jan 12 11:30:02 2005
Subject: [SC-Help] Re: Getting balcklisted
References: <cs2o2s$87g$1@news.spamcop.net> <cs35cr$f91$1@news.spamcop.net>
	<cs36d0$ftq$1@news.spamcop.net>
	<mailman.61.1105545498.4572.spamcop-help@news.spamcop.net>
	<cs3i7e$nio$1@news.spamcop.net>
Message-ID: <cs3j4o$o62$1@news.spamcop.net>

Iain wrote:
> Obviously there is no way to not send the first welcome message and
> this may go to the wrong person.

Not 'welcome'.  Confirm.

The concept is that someone visits your website and reads the
information about getting on the list;  ie receiving wanted information
from you.  They respond to that by putting in their email address.  When
they do that, they are *not* subscribed.  That email address may be a
bogus one to cause trouble.  It may be a spamtrap address to cause
trouble.  Think of yourself as being surrounded by enemies to your
mailing list who are also enemies of antispam activities, blocklists and
such as that.  Devious plotters out to get you.

So, now you have an email address which might be real or it might be
poison.  Handle it carefully.

You email the address a confirmation.  In order to get any more
information from you, the recipient of the email has to confirm that
they received the email you sent and that they indeed /do/ want to get
more mail from you regarding the issue in question.  That confirmatory
mail contains some way to indicate its uniqueness.  Either in the
content of the mail which they will be returning with their Reply
function, or by clicking on a unique link in the email to trip a
confirmatory website visit which only a recipient of the email could
perform.

If all of that [either the unique email reply or the unique website
visit] doesn't happen in confirmation, then the email addy which was
initially entered at the website isn't subscribed.  The initial email
addy only becomes subscribed by the process described.

If and only if, when and only when, all of the above has already taken
place is such an address a valid subscriber.  If all of that, only then
does that subscribed email address need to unsub [or be invalid] to
become unsubbed.  And, they should be able to unsub by email or website
visit;  either one.



-- 
Mike Easter
kibitzer, not SC admin

From MikeE at ster.invalid  Wed Jan 12 08:35:15 2005
From: MikeE at ster.invalid (Mike Easter)
Date: Wed Jan 12 11:35:03 2005
Subject: [SC-Help] Re: Getting balcklisted
References: <cs2o2s$87g$1@news.spamcop.net> <cs35cr$f91$1@news.spamcop.net>
	<cs36d0$ftq$1@news.spamcop.net>
	<mailman.61.1105545498.4572.spamcop-help@news.spamcop.net>
	<cs3i7e$nio$1@news.spamcop.net> <cs3j4o$o62$1@news.spamcop.net>
Message-ID: <cs3jh1$ogs$1@news.spamcop.net>

Mike Easter wrote:
> You email the address a confirmation.  In order to get any more
> information from you, the recipient of the email has to confirm that
> they received the email you sent and that they indeed /do/ want to get
> more mail from you regarding the issue in question.  That confirmatory
> mail contains some way to indicate its uniqueness.

In addition, that confirmatory mail can name the IP address of the
browser entrant of the email address which you have mailed the
confirmation item.  The datestamp as well if you like.  That way if
someone is going around causing trouble by entering bogus or spamtrap
information, they may get nabbed by the person bogus subscribed
notifying the provider for the IP address.

Ratting out the bogus subscribers to mailing lists is a good thing;  and
you can facilitate it by including the IP address of the browser
entering the wannabe subscriber address into your initiating webform.

-- 
Mike Easter
kibitzer, not SC admin

From ipmarketing at spamcop.net  Wed Jan 12 16:40:25 2005
From: ipmarketing at spamcop.net (Iain)
Date: Wed Jan 12 11:45:03 2005
Subject: [SC-Help] Re: Getting balcklisted
References: <cs2o2s$87g$1@news.spamcop.net> <cs35cr$f91$1@news.spamcop.net>
	<cs36d0$ftq$1@news.spamcop.net> <cs3fab$l7e$1@news.spamcop.net>
	<cs3hfj$mpv$1@news.spamcop.net>
Message-ID: <cs3jtr$osv$1@news.spamcop.net>

I don't quite follow this, and no I've not yet read the link you previous 
sent, but will be studying it carefully, believe you me! However, you 
write...

"Nope.  That's not good enough.  If I 'accidentally' receive some mailing 
from someone, it isn't my job to unsubscribe.  A great many reporters will 
always report that as spam and not unsub."

So then, the very first Email that is sent as a part of the opt-in process 
would under your comments get reported as spam if the user wasn't expecting 
it - caused by the original web user giving someone else's address for 
whatever reason? That is a no-win situation you describe as I have no way to 
test the address provided - ever - unless I send mail to it! You also write:

"The confirmation mail when someone first subscribes to something must 
contain no 'content' other than its own confirmation."

So then, if you're the recipient of a message with 'no content' sent to you 
because someone else gave your Email address as their own address, this is 
going to help you? Surely a message that explains what it is, why it is 
being sent to the person and what to do if they do/do not want it - a 
'welcome message' - is a lot better than something with 'no content'. If by 
'no content' you mean not a first in the series of the information feed, 
then that is *precisely* what I'm describing and why we're thinking of this 
as a 'welcome message' (on the basis the vast majority of sign-ups will be 
for people who want the service and give a correct address). I have not 
described a 'content message', only one explicitly related to the sign-up, 
it's purpose and what to do.

My point about addresses 'going invalid', is that just because you get an 
opt-in message does not mean the address will be good forever. It means it 
was okay and the user wanted it at that time, but the address may lapse for 
many reasons. If *the ISP* then invokes rules about mail being sent to 
invalid mail addresses you fall into that problem despite the opt-in. So, 
let's say there's a number of people all opted-in from a company and then 
for some reason that company's Email addresses get suspended, suddenly we'd 
be sending mail to multiple invalid addresses. Yes we need to process 
'invalid address' replies, but we can't do that until we get the bounces and 
we need to try all the addresses to know they're all now bad. In this 
instance the opt-in doesn't buy us any protection. I was particularly 
interested in knowledge about ISP's 'general rules' about receiving bad 
Email that might be spam - remember my point about AOL - not just users who 
want to report stuff to abuse addresses.

I also do not understand your comments about 'a dirty list' when the whole 
purpose of posting this is *precisely* to establish the best, most 
spam-protected means of allowing users to subscribe for Email notifications 
and ensuring that for whatever reason, inadvertent or malevolent, users 
cannot sign up someone else to receive Email they don't want. It is 
precisely because we're trying to ensure the list is not only clean but up 
to date we're going through this exercise!

.../Iain


"Mike Easter" <MikeE@ster.invalid> wrote in message 
news:cs3hfj$mpv$1@news.spamcop.net...
> Iain wrote:
>> It's all about proper informed
>> opt-in, so let's take all that as accepted.
>
> We'll see.
>
>> 1. You send a welcome message (as advised when they signed up)
>> confirming their set-up of Email information and including an
>> unsubscribe link for one-click removal if for some reason they want
>> to cancel the subscription.
>
> No.  That is opt-out.  We're looking for/ discussing/ confirmation of
> having subscribed.  They shouldn't be subscribed until they have
> properly confirmed that they have subscribed.
>
>>  The idea here is that if the address is
>> someone elses, that someone else has a fast way of saying; "This is
>> nothing to do with me. I don't want to receive any information." This
>> is the best we can do at this point.
>
> Nope.  That's not good enough.  If I 'accidentally' receive some mailing
> from someone, it isn't my job to unsubscribe.  A great many reporters
> will always report that as spam and not unsub.
>
>> 2. If the user inadvertently enters someone elses address, i.e. a
>> valid address but not their own, then the incorrect recipient would
>> have an immediate 'get me out of this' link as described.
>
> Nope.  That doesn't work.  I don't think you read the link I gave you.
>
>> If the
>> incorrect chose not to immediately unsubscribe then they implcitly
>> agree to receive further mail.
>
> Nope.  No good.  That kind of list management is going to kill your
> dirty list.
>
>> That's what the welcome would say and
>> would advise they immediately use the "This has come to the wrong
>> person" link if they didn't want to continue to receive mail. In
>> addition every message sent subsequently would include such a "No
>> more mail" link. Again, this is the best we can do to allow someone
>> to remove their address.
>
> Nope.  No good.  You keep saying 'this is the best we can do' when that
> is no where near good enough.  I smell a dirty list.
>
>> 3. If the user gives us a completely wrong address or an address
>> which goes to some SMTP sink, then it's hard for us to know that
>> other than through parsing any reply back from the recipient ISP.
>> Obviously the 'unsubscribe' link can't be clicked, but I don't see
>> how we can realistically do anything but send a welcome message to
>> the address the user gives us. Or do you think differently??
>
> Yes.  I think completely differently.  We aren't even on the same page
> because you are using euphemisms which mean exactly the opposite of
> their language.  You are using the word 'welcome' to indicate a demand
> that some unwilling recipient is supposed to opt-out of getting any more
> of something they never wanted.  That's like calling a spam a 'welcome
> to my spam' message.
>
>> 4. Now point 3 above makes the case for requiring a positive; "Yes
>> thank you for the welcome Email and I confirm I want to continue
>> receiving it" reply. This would prevent a second Email being sent to
>> the same address if say it was some kind of sink (and so no
>> bounce/non-delivery report would come back) unless the positive reply
>> had been received. However, two issues:
>
> The confirmation mail when someone first subscribes to something must
> contain no 'content' other than its own confirmation.
>
>> 4a. Although we can collect a positive confirmation 'by a unique
>> token' it doesn't actually tell us that the person making that
>> positive confirmation is the same person who gave us the address.
>
> It does if it is performed correctly.  This is about email and an email
> address.  The confirmatory email is sent which requests the
> confirmation.  If the confirmation isn't received, the person isn't
> subscribed and they get nothing else.  That is confirming the
> subscription by opting in, not out.
>
>> They could have given us a correct address for some other person and
>> that other person, for whatever reason, clicked the 'I want to
>> confirm my Opt-in' link. So we have a positive opt-in, but not from
>> the right person
>
> I was speaking of emailing the confirmation.  If a person is sent a
> confirmation and they confirm, they are subscribed.  Your imagining that
> someone is going to optin to something they didn't want is far-fetched.
>
>> 4b. We could ensure that the confirmation was from the right person by
>> making the person log back into the web service to make their
>> confirmation. This ensures that the person who set up the Email also
>> has access to the 'unique token' sent in the welcome message. So this
>> is a high degree of verification, but also a high degree of nuisance
>> for the user and our business manager's want to make the Email
>> sign-up simple and quick and not to require re logins
>
> You can do it with a unique web login or you can do it with a unique
> email reply.  It can be done properly either way.
>
>> 4c. Even if we go through either a 'weak' verification (4a) or strong
>> verification (4b) exercise of confirming the Email address and opt-in
>> status, the Email address could at any point in time be deleted,
>> suspended or otherwise become invalid without us knowing. At that
>> point we would (unknowingly) continue to send Email to the
>> positiviely verified address but which was no longer valid.
>
> There's also the issue of how to handle bounces for 'no longer valid'.
>
>> At that
>> point we're pretty much in the same position as at point 2 in that
>> we'd be sending Email to an ISP to an address that didn't exist/was
>> invalid. So, if sending mail to invalid addresses is liable to get
>> the sending domain blacklisted, then we're just as lilkely to be
>> blacklisted at this point as we are at point 2. That then begs the
>> question, what do we gain from the verification steps as the
>> verification is only at a point in time and the address may become
>> invalid for any number of reasons at any time and so we're into
>> sending mail to non-existant mail addresses
>
> That sounds like some kind of lame excuse for the problems described at
> the top.  Your top part is a much bigger problem than this bottom part.
>
>> What I am therefore trying to work through - and I'm readin various
>> other sources but thought I'd ask here - is what is 'best practice'
>> and what ensure the department won't end up being blacklisted either
>> due to deliberate action by someone (deliberately giving false mail
>> addresses) or due to accidental input of an Email address or through
>> an Email address lapsing/becoming invalid at some point after being
>> verified.
>
> -- 
> Mike Easter
> kibitzer, not SC admin
> 


From ipmarketing at spamcop.net  Wed Jan 12 16:44:03 2005
From: ipmarketing at spamcop.net (Iain)
Date: Wed Jan 12 11:45:06 2005
Subject: [SC-Help] Re: Getting balcklisted
References: <cs2o2s$87g$1@news.spamcop.net> <cs35cr$f91$1@news.spamcop.net>
	<cs36d0$ftq$1@news.spamcop.net>
	<mailman.61.1105545498.4572.spamcop-help@news.spamcop.net>
	<cs3i7e$nio$1@news.spamcop.net> <cs3j4o$o62$1@news.spamcop.net>
	<cs3jh1$ogs$1@news.spamcop.net>
Message-ID: <cs3k4l$oul$1@news.spamcop.net>

That is a very good idea - and one I've seen before - but an excellent idea. 
Thanks for it :-)


"Mike Easter" <MikeE@ster.invalid> wrote in message 
news:cs3jh1$ogs$1@news.spamcop.net...
> Mike Easter wrote:
>> You email the address a confirmation.  In order to get any more
>> information from you, the recipient of the email has to confirm that
>> they received the email you sent and that they indeed /do/ want to get
>> more mail from you regarding the issue in question.  That confirmatory
>> mail contains some way to indicate its uniqueness.
>
> In addition, that confirmatory mail can name the IP address of the
> browser entrant of the email address which you have mailed the
> confirmation item.  The datestamp as well if you like.  That way if
> someone is going around causing trouble by entering bogus or spamtrap
> information, they may get nabbed by the person bogus subscribed
> notifying the provider for the IP address.
>
> Ratting out the bogus subscribers to mailing lists is a good thing;  and
> you can facilitate it by including the IP address of the browser
> entering the wannabe subscriber address into your initiating webform.
>
> -- 
> Mike Easter
> kibitzer, not SC admin
> 


From ipmarketing at spamcop.net  Wed Jan 12 16:48:28 2005
From: ipmarketing at spamcop.net (Iain)
Date: Wed Jan 12 11:50:03 2005
Subject: [SC-Help] Re: Getting balcklisted
References: <cs2o2s$87g$1@news.spamcop.net> <cs35cr$f91$1@news.spamcop.net>
	<cs36d0$ftq$1@news.spamcop.net>
	<mailman.61.1105545498.4572.spamcop-help@news.spamcop.net>
	<cs3i7e$nio$1@news.spamcop.net> <cs3j4o$o62$1@news.spamcop.net>
Message-ID: <cs3kcu$peu$1@news.spamcop.net>

Well in fact one of the things I've been planning is that not only would 
there be a confirmatory link (with unique token) for the opt-in, but that 
some of the notifications the person is signing up to receive will need to 
have them come back for a web session. My thought then is that such 
notifications should include a helpful 'quick launch' link to take them to 
the relevant web resource and the URI again carries a unique token. 
Therefore, (provided they use the 'handy link' - which they may or may not 
do) we'd get confirmation that the address was good not only at opt-in, but 
potentially at every use of the link. That would give us something more 
current that just the opt-in confirmation.

.../Iain


"Mike Easter" <MikeE@ster.invalid> wrote in message 
news:cs3j4o$o62$1@news.spamcop.net...
> Iain wrote:
>> Obviously there is no way to not send the first welcome message and
>> this may go to the wrong person.
>
> Not 'welcome'.  Confirm.
>
> The concept is that someone visits your website and reads the
> information about getting on the list;  ie receiving wanted information
> from you.  They respond to that by putting in their email address.  When
> they do that, they are *not* subscribed.  That email address may be a
> bogus one to cause trouble.  It may be a spamtrap address to cause
> trouble.  Think of yourself as being surrounded by enemies to your
> mailing list who are also enemies of antispam activities, blocklists and
> such as that.  Devious plotters out to get you.
>
> So, now you have an email address which might be real or it might be
> poison.  Handle it carefully.
>
> You email the address a confirmation.  In order to get any more
> information from you, the recipient of the email has to confirm that
> they received the email you sent and that they indeed /do/ want to get
> more mail from you regarding the issue in question.  That confirmatory
> mail contains some way to indicate its uniqueness.  Either in the
> content of the mail which they will be returning with their Reply
> function, or by clicking on a unique link in the email to trip a
> confirmatory website visit which only a recipient of the email could
> perform.
>
> If all of that [either the unique email reply or the unique website
> visit] doesn't happen in confirmation, then the email addy which was
> initially entered at the website isn't subscribed.  The initial email
> addy only becomes subscribed by the process described.
>
> If and only if, when and only when, all of the above has already taken
> place is such an address a valid subscriber.  If all of that, only then
> does that subscribed email address need to unsub [or be invalid] to
> become unsubbed.  And, they should be able to unsub by email or website
> visit;  either one.
>
>
>
> -- 
> Mike Easter
> kibitzer, not SC admin
> 


From MikeE at ster.invalid  Wed Jan 12 09:23:58 2005
From: MikeE at ster.invalid (Mike Easter)
Date: Wed Jan 12 12:25:02 2005
Subject: [SC-Help] Re: Getting balcklisted
References: <cs2o2s$87g$1@news.spamcop.net> <cs35cr$f91$1@news.spamcop.net>
	<cs36d0$ftq$1@news.spamcop.net> <cs3fab$l7e$1@news.spamcop.net>
	<cs3hfj$mpv$1@news.spamcop.net> <cs3jtr$osv$1@news.spamcop.net>
Message-ID: <cs3mcb$qoi$1@news.spamcop.net>

Iain wrote:
> So then, the very first Email that is sent as a part of the opt-in
> process would under your comments get reported as spam if the user
> wasn't expecting it - caused by the original web user giving someone
> else's address for whatever reason? That is a no-win situation you
> describe as I have no way to test the address provided - ever -
> unless I send mail to it!

There are all kinds of spam reporters.  We'll use me as an example.  If
I receive an item which is 'purely' confirmatory, not promoting itself
or its products or its purpose in any way, and whose entire purpose is
to tell me that my address has been entered as desirous of wanting to be
on that mailing list -- and, that in order for me to be so subscribed
then I must click this link or reply this mail, else the subscription
process fails -- then I do not report that as spam.  That
non-reportability is aided by my observation that the From of the sender
and the source of the confirmatory mail and other elements of the header
show no bogosity;  that the item was 'straightup' From = source and
nonabusive to any proxies.

OTOH, some spamcop reporters are triggerhappy and kneejerkish.  So, if
they get something which they don't recognize, they might spamcop report
it.  That is against the spamcop rules which sez to not report
confirmatory items.  But, your problem is that if such a spamcop
reporter gets your mail, their spamcop notify doesn't provide you with
the email address to which you sent the confirmation.  The spamcop
reporting process acts as an anonymizer, so you can see a problem
developing for your list there.

In addition, if a spamtrap receives your confirmatory mail, then that
can cause your mailing list to be named as a spamsource as well.

> "The confirmation mail when someone first subscribes to something must
> contain no 'content' other than its own confirmation."
>
> So then, if you're the recipient of a message with 'no content' sent
> to you because someone else gave your Email address as their own
> address, this is going to help you? Surely a message that explains
> what it is, why it is being sent to the person and what to do if they
> do/do not want it - a 'welcome message' - is a lot better than
> something with 'no content'.

Let's be careful about not 'overinterpreting' no content -- just like we
must be careful about not misusing 'welcome'.  What I meant by no
content was no content which is promoting the item.  Some mailing lists
think they can send something out promoting itself and be so convincing
that the person they sent it to decides that they want it.  What I mean
is no content promoting anything, including itself.  The purpose is for
confirmation, not promotion.  Obviously there would be enough 'content'
that the person could tell that it was something they had just
requested.  There are many ways of doing that without the item promoting
itself or being an 'issue' of the mailing list subscription.

Let us also be careful about this welcome business.  Earlier we were
talking about someone being sent a subscription to something welcoming
them, telling them how great this item is, in order to convince them to
subscribe.  Or to not unsubscribe.  That would be considered a
'promotional' welcome.  When I say no content, I mean no promotional
content.  Only confirmatory content.

> My point about addresses 'going invalid', is that just because you
> get an opt-in message does not mean the address will be good forever.
> It means it was okay and the user wanted it at that time, but the
> address may lapse for many reasons. If *the ISP* then invokes rules
> about mail being sent to invalid mail addresses you fall into that
> problem despite the opt-in.

I can't comment on all of the different kinds of mail managements that
recipient ISPs may do.  The ideal situation would be that if you emailed
an invalid address that the mail would 'bounce' where bounce means be
permanently rejected before transmission;  ie not accepted for delivery.

Emailing a dead or invalid address is quite a different matter than
emailing a spamtrap address.

> So, let's say there's a number of people
> all opted-in from a company and then for some reason that company's
> Email addresses get suspended, suddenly we'd be sending mail to
> multiple invalid addresses.

That's a crazy scenario.  When you use your imagination like that it
smells like a dirty list again.

 >Yes we need to process 'invalid address'
> replies, but we can't do that until we get the bounces and we need to
> try all the addresses to know they're all now bad.

Same crazy scenario.  Doesn't make any sense to me.

> I also do not understand your comments about 'a dirty list' when the
> whole purpose of posting this is *precisely* to establish the best,
> most spam-protected means of allowing users to subscribe for Email
> notifications and ensuring that for whatever reason, inadvertent or
> malevolent, users cannot sign up someone else to receive Email they
> don't want. It is precisely because we're trying to ensure the list
> is not only clean but up to date we're going through this exercise!

The reason I mention 'dirty list' is because all to often when someone
starts 'worrying about' getting 'balcklisted' ;-) they are worrying
because they *have* a list and they are worried about using it.  Anyone
who has a list and starts worrying about it almost universally has a
dirty list;  that is, they don't have a proper list at all;  so they
don't have a list.

If you don't have a list, then you don't have a dirty list.  If you have
a list and you're worried about what might happen when you mail to it,
then you have a dirty list.

-- 
Mike Easter
kibitzer, not SC admin

From MikeE at ster.invalid  Wed Jan 12 09:33:54 2005
From: MikeE at ster.invalid (Mike Easter)
Date: Wed Jan 12 12:35:03 2005
Subject: [SC-Help] Re: Getting balcklisted
References: <cs2o2s$87g$1@news.spamcop.net> <cs35cr$f91$1@news.spamcop.net>
	<cs36d0$ftq$1@news.spamcop.net> <cs3fab$l7e$1@news.spamcop.net>
	<cs3hfj$mpv$1@news.spamcop.net> <cs3jtr$osv$1@news.spamcop.net>
	<cs3mcb$qoi$1@news.spamcop.net>
Message-ID: <cs3muv$r69$1@news.spamcop.net>

Mike Easter wrote:
> If I receive an item which is 'purely' confirmatory, not promoting
> itself or its products or its purpose in any way, and whose entire
> purpose is to tell me that my address has been entered as desirous of
> wanting to be on that mailing list -- and, that in order for me to be
> so subscribed then I must click this link or reply this mail, else
> the subscription process fails -- then I do not report that as spam.

In fact, if the item also included the IP of the browser who entered the
email address, I would be notifying the abuse desk of the provider for
that IP address that their client was bogus subscribing people.  Abuse
desk definitely don't like that business;  they are very sensitive to
abuse issues because that is their job, and they are highly likely to
take action on the bogus subscribing person.  So, the timestamp would be
helpful too, in case the IP was dynamic.

It is more likely for a person who has been bogus subscribed to 'take
some action' against the bogus subscriber by notifying hir provider's
abuse than it is for some kind of 'correspondence' to develop between
the bogus subscribed and the list manager to cause the list manager to
be notifying the bogus subscriber's provider.  That is, the list manager
doesn't know any true answers to why a bogus subscription never got
confirmed, so they can't notify anyone.  The person who was bogus
subscribed *knows* that they didn't subscribe, so they are in a position
to be notifying the provider for the bogus subscriber.

-- 
Mike Easter
kibitzer, not SC admin

From wb8tyw at qsl.network  Wed Jan 12 11:43:57 2005
From: wb8tyw at qsl.network (John E. Malmberg)
Date: Wed Jan 12 12:45:03 2005
Subject: [SC-Help] Re: Getting balcklisted
References: <cs2o2s$87g$1@news.spamcop.net> <cs35cr$f91$1@news.spamcop.net>
	<cs36d0$ftq$1@news.spamcop.net>
	<mailman.61.1105545498.4572.spamcop-help@news.spamcop.net>
	<cs3i7e$nio$1@news.spamcop.net>
Message-ID: <TYh57xdb8UDY@eisner.encompasserve.org>

In article <cs3i7e$nio$1@news.spamcop.net>,
"Iain" <ipmarketing@spamcop.net> writes:

Please stop top posting and not trimming.

Normal communication mode for newsgroups is to post directly under the
statement you are commenting on, and deleting as much of the previous message
as possible with out losing context.  Look at the format of all the replies
that you have received so far.

> Obviously there is no way to not send the first welcome message and this may
> go to the wrong person.
>
> Sending people Email links to log into banking/tax
> services is another concern. So in the same way you say people will never
> click an unsubscribe link (you'd not click an unsubsctibe link going to
> www.irs.gov? - not that this is for the IRS, but you get my point?) then
> people might also not follow-through on an Email link that results in them
> being asked for their login credentials!

If the person's e-mail client has HTML enabled, phishers and spammers can
hide the URLs so that it looks like an unsubscribe link is going to a different
address.

The only people that you can expect to reply or click on a confirmation link
are the people who requested the information.

Until someone replies to the message or clicks on the confirmation link, you
do not have any proof that the e-mail address is good.

For lists that mail less than once a month on average, it is a good idea to
require annual resubscriptions.


HTML formatted mail, or mail with any attachments should not be sent to anyone
that has not expressly stated that they want HTML formatted mailings.
It should not be the default setting.  Having HTML in a message increases
the risk that a poorly implemented spam filter will discard the message.

> There are ways to mitigate the phishing risk (which I'll not go into here),
> but my point is, the 'obvious' best practice from an anti-spam point of view
> may not be the 'best practice' from an anti-phishing perspective. So it's
> all a balance...hence the churning of thoughts :-)

A phish e-mail is not expected.  Therefore clicking on it or responding
to it is not advised.

A confirmation request for information that was not recently requested is
not expected, therefore clicking on it or responding is not advised.

A confirmation request for information that was recently requested is something
that you can assume safe to respond to.


If someone is still vulunerable to phishing, the only way to protect them is
to keep them away from internet e-mail and allow no unscreened incoming phone
calls.

-John
wb8tyw@qsl.network
Personal Opinion Only
From nobody at spamcop.net  Wed Jan 12 14:58:34 2005
From: nobody at spamcop.net (Ellen)
Date: Wed Jan 12 15:00:02 2005
Subject: [SC-Help] SpamCop outage
Message-ID: <cs3vfv$rc$1@news.spamcop.net>

We anticipate a brief outage of 15-30 minutes sometime in the next couple of
hours as we move some hardware around. Please be patient as the outage
should be brief. Thanks!

Ellen
SpamCop

If someone will propagate this to the appropriate forum groups I would
appreciate it.
Follow-ups to spamcop.



From sysop at scbbs.com  Wed Jan 12 13:20:13 2005
From: sysop at scbbs.com (Ron Parker)
Date: Wed Jan 12 16:05:21 2005
Subject: [SC-Help] looks like a dynamic host, untrusted as relay
Message-ID: <cs436u$3fm$1@news.spamcop.net>

Hi.  Recently, all the reports I have submitted have listed my 
mailserver IP as the source of the spam (even though in the message 
header, you can see the actual source IP(s) in the line(s) below the one 
where my host receives the mail).  When I look at the spam processing I 
see a line indicating that my IP "looks like a dynamic host, untrusted 
as relay".  My mailserver is not a dynamic host.  So, the question is:  
What do I do to resolve this issue?  Thanks.

-ron

From MikeE at ster.invalid  Wed Jan 12 13:14:32 2005
From: MikeE at ster.invalid (Mike Easter)
Date: Wed Jan 12 16:15:03 2005
Subject: [SC-Help] Re: looks like a dynamic host, untrusted as relay
References: <cs436u$3fm$1@news.spamcop.net>
Message-ID: <cs43sl$3tk$1@news.spamcop.net>

Ron Parker wrote:
> Hi.  Recently, all the reports I have submitted have listed my
> mailserver IP as the source of the spam (even though in the message
> header, you can see the actual source IP(s) in the line(s) below the
> one where my host receives the mail).  When I look at the spam
> processing I see a line indicating that my IP "looks like a dynamic
> host, untrusted as relay".  My mailserver is not a dynamic host.  So,
> the question is: What do I do to resolve this issue?  Thanks.

You are spending a lot of words describing/ trying to describe/
something which you could demonstrate comprehensively and accurately
with a single click on the reader's part.

Post a tracker, not a description of a parse.

This is a tracker and its context:

Here is your TRACKING URL - it may be saved for future reference:
http://www.spamcop.net/sc?id=z711969573zbbb5c84c34949b118dc96df2ace67925z

found at the top of a parse before cancelling or reporting.

I prefer to abbreviate them as below by removing the http:// part
because some newsreaders break the longline

www.spamcop.net/sc?id=z711969573zbbb5c84c34949b118dc96df2ace67925z

That tracker gives one access to not only the original spam, but also
spamcop's parsing of it;  so whoever is looking at it is seeing what you
are seeing [most likely, unless the parse changes] instead of your
description.

The only thing worth talking about is the /real/ headers and the /real/
parse;  not some theoretical headers and some hypothetical parse you are
describing in general terms.


-- 
Mike Easter
kibitzer, not SC admin

From nobody at spamcop.net  Wed Jan 12 16:47:02 2005
From: nobody at spamcop.net (Ellen)
Date: Wed Jan 12 17:40:04 2005
Subject: [SC-Help] Re: looks like a dynamic host, untrusted as relay
References: <cs436u$3fm$1@news.spamcop.net>
Message-ID: <cs48n2$786$2@news.spamcop.net>



"Ron Parker" <sysop@scbbs.com> wrote in message
news:cs436u$3fm$1@news.spamcop.net...
> Hi.  Recently, all the reports I have submitted have listed my
> mailserver IP as the source of the spam (even though in the message
> header, you can see the actual source IP(s) in the line(s) below the one
> where my host receives the mail).  When I look at the spam processing I
> see a line indicating that my IP "looks like a dynamic host, untrusted
> as relay".  My mailserver is not a dynamic host.  So, the question is:
> What do I do to resolve this issue?  Thanks.
>

Send me the IP and your registered SpamCop email address and I will look at
it.  deputies <at> spamcop.net

Ellen
SpamCop


From ipmarketing at spamcop.net  Thu Jan 13 21:09:30 2005
From: ipmarketing at spamcop.net (Iain)
Date: Thu Jan 13 16:10:03 2005
Subject: [SC-Help] Re: Getting balcklisted
References: <cs2o2s$87g$1@news.spamcop.net> <cs35cr$f91$1@news.spamcop.net>
	<cs36d0$ftq$1@news.spamcop.net> <cs3fab$l7e$1@news.spamcop.net>
	<cs3hfj$mpv$1@news.spamcop.net> <cs3jtr$osv$1@news.spamcop.net>
	<cs3mcb$qoi$1@news.spamcop.net>
Message-ID: <cs6o2e$nat$1@news.spamcop.net>

Well the 'item being promoted' is electronic reminders from a Government 
department that tax payments are due, so even if a message did have 
'content' - You are subscribed to receive tax reminders and this is to 
remind you your tax is now due - I defy even the most hardened spam reporter 
to consider that a message like that is selling or promoting something! I 
know Government departments now like to refer to taxpayers as customers, but 
to consider they are 'selling' tax to citizens really is going a bit far :-)

No there is no list in pre-existance, this all about how to properly allow 
users to ask to receive tax information - or more likely notification there 
is information available on the web or that they need to submit via the 
web - and then ensuring the mail goes to the right person. The reason for 
all the care about checking the user and wanting as best as we can to ensure 
the Email address being provided is valid, good, remains good and and is for 
the right person, is that it's to do with tax compliance. If someone asks to 
be reminded that their tax is due and due to a sloppy list they don't get 
the reminder, then we don't want to get into a legal situation where the 
person claims their non-compliance is because they never got the reminder.

Now granted that SMTP isn't the most reliable way of doing things, but it's 
the nearest equivalent to a letter in the mailbox so we have to use it. The 
issue is how to try and make it as reliable as possible and as convenient to 
use. THAT is why I'm so interested in making sure we don't get blacklisted 
either by malicious action of someone trying to subscribe a spamtrap to an 
alert and why I'm so interested in what automated actions an ISP might take 
if, say, a block of addresses go invalid because a businesses Email is all 
suspended. You might think that a crazy scenario, but I don't want to be the 
one that explains that the reason some large number of people have suddenly 
stopped paying their tax is because the mail alert system has been 
blacklisted because I didn't think something through. So excuse me, I need 
to be very thorough...I'm not trying to sell "Italian Rolexs" (don't these 
muppets know Rolex is a Swiss company anyway?!)

So if you'll bear with me, I will have more questions as I try and establish 
'the best' solution in terms of user convenience and experience, avoid a 
major Government department becoming a spammer either due to inadvertent or 
malicous supply of Email addresses or other means yet ensure the 'best' 
means of ensuring reliable delivery of important information over an 
unreliable carrier :-)

.../Iain


"Mike Easter" <MikeE@ster.invalid> wrote in message 
news:cs3mcb$qoi$1@news.spamcop.net...
> Iain wrote:
>> So then, the very first Email that is sent as a part of the opt-in
>> process would under your comments get reported as spam if the user
>> wasn't expecting it - caused by the original web user giving someone
>> else's address for whatever reason? That is a no-win situation you
>> describe as I have no way to test the address provided - ever -
>> unless I send mail to it!
>
> There are all kinds of spam reporters.  We'll use me as an example.  If
> I receive an item which is 'purely' confirmatory, not promoting itself
> or its products or its purpose in any way, and whose entire purpose is
> to tell me that my address has been entered as desirous of wanting to be
> on that mailing list -- and, that in order for me to be so subscribed
> then I must click this link or reply this mail, else the subscription
> process fails -- then I do not report that as spam.  That
> non-reportability is aided by my observation that the From of the sender
> and the source of the confirmatory mail and other elements of the header
> show no bogosity;  that the item was 'straightup' From = source and
> nonabusive to any proxies.
>
> OTOH, some spamcop reporters are triggerhappy and kneejerkish.  So, if
> they get something which they don't recognize, they might spamcop report
> it.  That is against the spamcop rules which sez to not report
> confirmatory items.  But, your problem is that if such a spamcop
> reporter gets your mail, their spamcop notify doesn't provide you with
> the email address to which you sent the confirmation.  The spamcop
> reporting process acts as an anonymizer, so you can see a problem
> developing for your list there.
>
> In addition, if a spamtrap receives your confirmatory mail, then that
> can cause your mailing list to be named as a spamsource as well.
>
>> "The confirmation mail when someone first subscribes to something must
>> contain no 'content' other than its own confirmation."
>>
>> So then, if you're the recipient of a message with 'no content' sent
>> to you because someone else gave your Email address as their own
>> address, this is going to help you? Surely a message that explains
>> what it is, why it is being sent to the person and what to do if they
>> do/do not want it - a 'welcome message' - is a lot better than
>> something with 'no content'.
>
> Let's be careful about not 'overinterpreting' no content -- just like we
> must be careful about not misusing 'welcome'.  What I meant by no
> content was no content which is promoting the item.  Some mailing lists
> think they can send something out promoting itself and be so convincing
> that the person they sent it to decides that they want it.  What I mean
> is no content promoting anything, including itself.  The purpose is for
> confirmation, not promotion.  Obviously there would be enough 'content'
> that the person could tell that it was something they had just
> requested.  There are many ways of doing that without the item promoting
> itself or being an 'issue' of the mailing list subscription.
>
> Let us also be careful about this welcome business.  Earlier we were
> talking about someone being sent a subscription to something welcoming
> them, telling them how great this item is, in order to convince them to
> subscribe.  Or to not unsubscribe.  That would be considered a
> 'promotional' welcome.  When I say no content, I mean no promotional
> content.  Only confirmatory content.
>
>> My point about addresses 'going invalid', is that just because you
>> get an opt-in message does not mean the address will be good forever.
>> It means it was okay and the user wanted it at that time, but the
>> address may lapse for many reasons. If *the ISP* then invokes rules
>> about mail being sent to invalid mail addresses you fall into that
>> problem despite the opt-in.
>
> I can't comment on all of the different kinds of mail managements that
> recipient ISPs may do.  The ideal situation would be that if you emailed
> an invalid address that the mail would 'bounce' where bounce means be
> permanently rejected before transmission;  ie not accepted for delivery.
>
> Emailing a dead or invalid address is quite a different matter than
> emailing a spamtrap address.
>
>> So, let's say there's a number of people
>> all opted-in from a company and then for some reason that company's
>> Email addresses get suspended, suddenly we'd be sending mail to
>> multiple invalid addresses.
>
> That's a crazy scenario.  When you use your imagination like that it
> smells like a dirty list again.
>
> >Yes we need to process 'invalid address'
>> replies, but we can't do that until we get the bounces and we need to
>> try all the addresses to know they're all now bad.
>
> Same crazy scenario.  Doesn't make any sense to me.
>
>> I also do not understand your comments about 'a dirty list' when the
>> whole purpose of posting this is *precisely* to establish the best,
>> most spam-protected means of allowing users to subscribe for Email
>> notifications and ensuring that for whatever reason, inadvertent or
>> malevolent, users cannot sign up someone else to receive Email they
>> don't want. It is precisely because we're trying to ensure the list
>> is not only clean but up to date we're going through this exercise!
>
> The reason I mention 'dirty list' is because all to often when someone
> starts 'worrying about' getting 'balcklisted' ;-) they are worrying
> because they *have* a list and they are worried about using it.  Anyone
> who has a list and starts worrying about it almost universally has a
> dirty list;  that is, they don't have a proper list at all;  so they
> don't have a list.
>
> If you don't have a list, then you don't have a dirty list.  If you have
> a list and you're worried about what might happen when you mail to it,
> then you have a dirty list.
>
> -- 
> Mike Easter
> kibitzer, not SC admin
> 


From ipmarketing at spamcop.net  Thu Jan 13 21:12:33 2005
From: ipmarketing at spamcop.net (Iain)
Date: Thu Jan 13 16:15:03 2005
Subject: [SC-Help] Re: Getting balcklisted
References: <cs2o2s$87g$1@news.spamcop.net> <cs35cr$f91$1@news.spamcop.net>
	<cs36d0$ftq$1@news.spamcop.net> <cs3fab$l7e$1@news.spamcop.net>
	<cs3hfj$mpv$1@news.spamcop.net> <cs3jtr$osv$1@news.spamcop.net>
	<cs3mcb$qoi$1@news.spamcop.net> <cs3muv$r69$1@news.spamcop.net>
Message-ID: <cs6o85$nlp$1@news.spamcop.net>

This is a very good ppint. Many thanks for it. Point well taken and noted! 
:-)

.../Iain


"Mike Easter" <MikeE@ster.invalid> wrote in message 
news:cs3muv$r69$1@news.spamcop.net...
> Mike Easter wrote:
>> If I receive an item which is 'purely' confirmatory, not promoting
>> itself or its products or its purpose in any way, and whose entire
>> purpose is to tell me that my address has been entered as desirous of
>> wanting to be on that mailing list -- and, that in order for me to be
>> so subscribed then I must click this link or reply this mail, else
>> the subscription process fails -- then I do not report that as spam.
>
> In fact, if the item also included the IP of the browser who entered the
> email address, I would be notifying the abuse desk of the provider for
> that IP address that their client was bogus subscribing people.  Abuse
> desk definitely don't like that business;  they are very sensitive to
> abuse issues because that is their job, and they are highly likely to
> take action on the bogus subscribing person.  So, the timestamp would be
> helpful too, in case the IP was dynamic.
>
> It is more likely for a person who has been bogus subscribed to 'take
> some action' against the bogus subscriber by notifying hir provider's
> abuse than it is for some kind of 'correspondence' to develop between
> the bogus subscribed and the list manager to cause the list manager to
> be notifying the bogus subscriber's provider.  That is, the list manager
> doesn't know any true answers to why a bogus subscription never got
> confirmed, so they can't notify anyone.  The person who was bogus
> subscribed *knows* that they didn't subscribe, so they are in a position
> to be notifying the provider for the bogus subscriber.
>
> -- 
> Mike Easter
> kibitzer, not SC admin
> 


From ipmarketing at spamcop.net  Thu Jan 13 21:21:36 2005
From: ipmarketing at spamcop.net (Iain)
Date: Thu Jan 13 16:25:03 2005
Subject: [SC-Help] Re: Getting balcklisted
References: <cs2o2s$87g$1@news.spamcop.net> <cs35cr$f91$1@news.spamcop.net>
	<cs36d0$ftq$1@news.spamcop.net>
	<mailman.61.1105545498.4572.spamcop-help@news.spamcop.net>
	<cs3i7e$nio$1@news.spamcop.net> <TYh57xdb8UDY@eisner.encompasserve.org>
Message-ID: <cs6op4$o6i$1@news.spamcop.net>

> Please stop top posting and not trimming.

Point taken...

> If the person's e-mail client has HTML enabled, phishers and spammers can
> hide the URLs so that it looks like an unsubscribe link is going to a 
> different
> address.

Phishing and effective anti-phishing actions are another whole area I'm 
looking at...and have some quite nice solutions for. It's a major issue with 
banks and Government department that I work with and has taken a good deal 
of thought. Anti-phishing will be incorporated in the solution :-)


> For lists that mail less than once a month on average, it is a good idea 
> to
> require annual resubscriptions.

That is included in plans by use of identifiable links what tell whether a 
subscribed Email address is still in use and being used to follow-up on 
alerts. A refinement would be an annual reconfirmation if such usage was 
noted so a nice idea. Frequency won't be great...maybe monthly or even 
quartler depending upon what's requested.


> HTML formatted mail, or mail with any attachments should not be sent to 
> anyone
> that has not expressly stated that they want HTML formatted mailings.

A very good point and noted


> If someone is still vulunerable to phishing, the only way to protect them 
> is
> to keep them away from internet e-mail and allow no unscreened incoming 
> phone
> calls.

If only it could be that simple but I do tend to agree :-)


.../Iain 


From MikeE at ster.invalid  Thu Jan 13 14:42:15 2005
From: MikeE at ster.invalid (Mike Easter)
Date: Thu Jan 13 17:45:32 2005
Subject: [SC-Help] Re: Getting balcklisted
References: <cs2o2s$87g$1@news.spamcop.net> <cs35cr$f91$1@news.spamcop.net>
	<cs36d0$ftq$1@news.spamcop.net> <cs3fab$l7e$1@news.spamcop.net>
	<cs3hfj$mpv$1@news.spamcop.net> <cs3jtr$osv$1@news.spamcop.net>
	<cs3mcb$qoi$1@news.spamcop.net> <cs6o2e$nat$1@news.spamcop.net>
Message-ID: <cs6td0$r6r$1@news.spamcop.net>

Iain wrote:
> Well the 'item being promoted' is electronic reminders from a
> Government department that tax payments are due,

I would still make that confirmatory message 'plain Jane' - purely for
the purpose of confirming the address entry and what the signup was
'about' - people seem to be notorious for forgetting when they signup
for something.

That's why I think it is very useful to have the confirmation include
the IP and the timestamp - it is additional information to help to
remind the person when it was they signed up and for the ones who are
familiar with their own IP that it was 'them' and when it was - and that
same infomation when provided to the bogus signup is so helpful that it
would tend to dissuade someone from reporting it as spam.

Whereas the 'welcome to our wonderful service' type of message which
looks 'promotional' even tho' we're talking about something as
disappealing as a tax being due might possibly be confused with
something;  or confused with something 'bogus'.  Remember that people
get all kinds of crazy unsolicited items.  You don't want your
confirmation confused with something crazy and unsolicited.  Especially
if it were a bogus subscribe.

> No there is no list in pre-existance, this all about how to properly
> allow users to ask to receive tax information

Good.  The way to make a really healthy list is to have in mind the
requirements for a good list before the first address goes onto it.

> If someone asks to be reminded that their tax is due
> and due to a sloppy list they don't get the reminder, then we don't
> want to get into a legal situation where the person claims their
> non-compliance is because they never got the reminder.

IMO [IANAL] there is no liability because someone didn't get their email
reminder somehow.

> but it's the nearest equivalent to a letter in the mailbox so we have
> to use it.

It is no where near the equivalent of snailmail.  I've seen major
lawsuits initiated with notification by snail mail, unregistered,
uncertified, sent in 'duplicate' - that is two different snails mailed -
and an employee of the legal firm simply signed a sworn statement that
she put the items into the USPS mail system.

smtp has many different things that can go wrong with it;  and while
digital transmissions which are signed and signed as received can be as
powerful as anything if the court will recognize the digital signature
functionality, saying smtp is 'equivalent' doesn't really work.  Under
the right structure, a digital transmission verified is much better/
more secure/ than a courier delivered with handwritten signed receipt of
something which could have been spoofed.

> So excuse me, I need to be very thorough...

You might consider the usage of receipts if you really think it would be
of value.  Personally I have my receipt gizmo turned off, or rather I
have it turned on to tell me if something wanted a receipt, but then I
refuse to give one.

> avoid a major Government department becoming a spammer
> either due to inadvertent or malicous supply of Email addresses

I completely concur with that plan.  Our major gov't departments do more
than their share of screwing up.  We see DoD .mil IP addresses being
abused for spam because they are insecure.

> other means yet ensure the 'best' means of ensuring reliable delivery
> of important information over an unreliable carrier :-)

Yes, I agree that normal email has unreliability features.  They can be
overcome or mitigated if so structured on both ends.

-- 
Mike Easter
kibitzer, not SC admin

From wb8tyw at qsl.network  Thu Jan 13 17:21:54 2005
From: wb8tyw at qsl.network (John E. Malmberg)
Date: Thu Jan 13 18:25:02 2005
Subject: [SC-Help] Re: Getting balcklisted
References: <cs2o2s$87g$1@news.spamcop.net> <cs35cr$f91$1@news.spamcop.net>
	<cs36d0$ftq$1@news.spamcop.net>
	<mailman.61.1105545498.4572.spamcop-help@news.spamcop.net>
	<cs3i7e$nio$1@news.spamcop.net> <TYh57xdb8UDY@eisner.encompasserve.org>
	<cs6op4$o6i$1@news.spamcop.net>
Message-ID: <8vTwXmsuJqaA@eisner.encompasserve.org>

In article <cs6op4$o6i$1@news.spamcop.net>,
   "Iain" <ipmarketing@spamcop.net> writes:
>
> Phishing and effective anti-phishing actions are another whole area I'm
> looking at...and have some quite nice solutions for. It's a major issue with
> banks and Government department that I work with and has taken a good deal
> of thought. Anti-phishing will be incorporated in the solution :-)

If you want to stop phishing, all you have to do is to get the anti-spam
laws in your country modified to hold the ISP hosting the spammer or allowing
the insecure system to relay spam responsible if they do not take action in
what should be a reasonable amount of time after notification should have
been able to be delivered to them.

Right now the laws provide penalties against the hard to locate perpetrator,
but totally ignore the liability of the enabler that could stop the crime
in progress with a few keystrokes and mouse clicks on a network management
console.

It seems that even if an ISP knows specifically that their customer is
breaking their countries spam law, that ISP is not held liable for allowing
after they have proof.  If your other laws worked the same way, you could
knowningly loan your car to a bank robber, and not worry about being arrested
if they got caught.  Your banking contacts should understand that.

For any ISP that provides 24*7 service, it should only take them 15 minutes if
they are slow.  If the site is still up or the security hole still present
after one business day, then put the owner of the ISP in jail until it the
problem is fixed.

In the law, such things are known as attractive nuisance, and the owner's of
such are generally liable for the damages that result.  So this is not new
or untried legal grounds.

My guess is that after the first time one of those ISP owners is a unwilling
guest of the jail that you will never see another phishing site hosted
in your country ever again, and you will also quickly see almost no spam
originating from anywhere in your country.

If the ISP has implemented a broken postmaster/abuse mailbox system that
prevents them from getting notifications in a timely mannor, then they
are negligent in their basic responsibilites in addition to allowing their
network to be used to abuse others.

Depending on what other control your country has, you can implement a policy
of null routing all I.P. traffic at the border from any foreign ISP hosting
a phishing site until that ISP certifies that it is gone.

It should only take a couple of times of a block for most ISP's to get the
message, unless you are in a very small country.

Note that an ISP ignoring a security hole that is relaying spam is costing
the ISP what could be significant money.  A lot of ISP's think that they
can just warn the owner of the infected machine and then wait 5 business days
to take action.

According to media interviews with convicted spammers, if they had to purchase
the bandwidth they can steal through a compromized computer, it would cost
them over $1,200 U.S. for those 5 business days that the ISP is waiting to
take action.

In addtion, one zombie computer being used to relay spam can knock out or
degrade the internet access of thousands of users on the network nearby it.

The ISPs that are not taking action on security holes are just passing the
costs on to their customers in addition to the service outages that it is
causing them.  And if they are a public company, their negligence in stopping
the bandwidth theft is costing their stockholders significant value.

If the electric and water utilites operated the same way as many of the
broadband ISPs, they would be taking no action against illegal taps that
they knew about and just passed the costs on to their law abiding customers.
Would your government allow that to be done to it's citizens?  After all
it would only be a few extra dollars per month on their bill when you
average it out.

And legal solution that does not hold the enabling ISP(s) liable for either
active participation or their wilful negligence is useless in getting spam
stopped.

-John
wb8tyw@qsl.network
Personal Opinion Only
From nobody at spamcop.net  Fri Jan 14 01:30:04 2005
From: nobody at spamcop.net (Doug)
Date: Thu Jan 13 20:35:04 2005
Subject: [SC-Help] Re: hotmail/msn, gmail, et.al.
References: <Xns95DB9543B5B2Dspamsucksabigone@216.154.195.61>
	<cs1o5d$jr4$1@news.spamcop.net> <cs1uga$o4k$1@news.spamcop.net>
Message-ID: <Xns95DDB1F4FDCA3spamsucksabigone@216.154.195.61>

"Mike Easter" <MikeE@ster.invalid> wrote in 
news:cs1uga$o4k$1@news.spamcop.net:

> Aviatrix wrote:
>> Doug wrote:
> 
>>> complaint to yahoo each time I see a domain registered with a yahoo
>>> address. I had read in one of the ng that such usage violates
>>> yahoo's TOS.
> 
>> Why are you doing this? How do you think it will help any cause?
> 
> The idea would be, if it were true, that /if/ yahoo, hotmail/msn, gmail
> had a policy against usage of their /free/ accounts 'commercially';  and
> /if/ the account in question /were/ free, which isn't automatic just
> because something is a yahoo or hotmail;  and /if/ the provider
> terminated the account because the use of the free account was for a
> commercial purpose ie as a 'business' to register the domain name;  and
> /if/ the domainname registration email address were lost;  /then/ the
> domainname registration wouldn't be 'any good', which would/could lead
> to loss of the domainname registration.  That would be part of a
> strategy for an attack on the domainname registration.
> 
> In support of that strategy, some have reported that hotmail, which is
> sometimes pretty quick on the trigger against complaints when properly
> addressed and documented, has terminated a hotmail account which
> facilitated the reporter eventually terminating a domainname
> registration.
> 
> In light of all of my wherefores and whereas/es and if then/s and
> therefores above, you can see that there is a tenuous chain between such
> a notification and something actually happening, along with some fuzzy
> information in the various TOSes and ambiguity of whether an account is
> free or not.  I just looked at gmail's, and it wasn't very convincing to
> me that the strategy would likely bear fruit on a TOS basis.
> 

That's my intended line of attack. Go after the domain reg for any spambag 
who uses a yahoo address in his registration. I have LARTed CN & KR hosted 
domains [as have everyone else] to no real end. If going after the domain 
reg helps by taking down even ONE spammer, then I'd feel like I did 
something constructive. Right now I just burn SC fuel and nothing happens.

What I'm looking for is any "good" [relative use] reporting addresses for 
hotmail/msn, and/or gmail.

TIA

-- 
Doug Goodwin
 YMMV

Violence is the last refuge of the incompetent.
-- Salvor Hardin
From TJLWBECGSGWU at spammotel.com  Fri Jan 14 03:05:32 2005
From: TJLWBECGSGWU at spammotel.com (Mathew Hendry)
Date: Thu Jan 13 22:10:03 2005
Subject: [SC-Help] Re: Need some Antispam/hacker 106 Assistance
References: <cs7bm6$4jc$1@news.spamcop.net>
Message-ID: <cadeu0djcdsf2pr8egclu3cqc7jkfcanc7@4ax.com>

[Original post in spamcop.spam, crossposted and followup set to
spamcop.help]

On Thu, 13 Jan 2005 17:42:10 -0900, "Fred K" <mfkmek820@yahoo.com> wrote:

>I got an email to one of my accounts that was a post to spamcop.

How do you mean "a post to spamcop"? A mail to a SpamCop mail account, a
spam report sent through spamcop, a post to the SpamCop newsgroups or forum,
or what?

>It had an 
>attachment with the text as follows. Anybody tell me what it means?

It's an odd one. GoToAssist seems to be a remote admin tool or some sort for
tech helpdesks, and this looks like a logfile produced when testing it. If
this was part of a spam report sent to you, it may be that it ended up in
someone's spambox and was reported in error.

-- Mat.

From 0rio85a02 at sneakemail.com  Thu Jan 13 18:29:19 2005
From: 0rio85a02 at sneakemail.com (Fred K)
Date: Thu Jan 13 22:30:04 2005
Subject: [SC-Help] Re: Need some Antispam/hacker 106 Assistance
References: <cs7bm6$4jc$1@news.spamcop.net>
	<cadeu0djcdsf2pr8egclu3cqc7jkfcanc7@4ax.com>
Message-ID: <cs7ean$6kt$1@news.spamcop.net>


"Mathew Hendry" <TJLWBECGSGWU@spammotel.com> wrote in message 
news:cadeu0djcdsf2pr8egclu3cqc7jkfcanc7@4ax.com...
> [Original post in spamcop.spam, crossposted and followup set to
> spamcop.help]

It was attached to an email sent to the addy I use  in my spamcop news
group. It was a copy of a postI made to spamcop, see:

http://www.spamcop.net/sc?id=z712422947z6549a7862216346c137f991004161c1ez

Fred k


From nobody at spamcop.net  Fri Jan 14 12:42:31 2005
From: nobody at spamcop.net (Pop)
Date: Fri Jan 14 12:45:05 2005
Subject: [SC-Help] Re: Getting balcklisted
References: <cs2o2s$87g$1@news.spamcop.net> <cs35cr$f91$1@news.spamcop.net>
	<cs36d0$ftq$1@news.spamcop.net> <cs3fab$l7e$1@news.spamcop.net>
	<cs3hfj$mpv$1@news.spamcop.net> <cs3jtr$osv$1@news.spamcop.net>
	<cs3mcb$qoi$1@news.spamcop.net> <cs6o2e$nat$1@news.spamcop.net>
Message-ID: <cs90a6$56o$1@news.spamcop.net>

>From the peanut gallery and purposely top-posted:
If you don't like it, respond to a different part of the thread; I'm not going to debate anything beyond this because it's much too long to be scrolling thru
.  
It is my considered opinion that you may have read, but did not fully comprehend, what you read.  I am a concussion victim and thus learning disabled and with memory retrieval problems, and yet I understood the response you received quite well, I think.  IMO, your response is more of a statement that you intend to do it your way regardless, as opposed to an open mind trying to get  a head around the issues in a way you can deal with them.  
   In other words, it leads me to more believe Mike's last closing paragraphs than anything else you have said.  If you don't like the answer, you don't have to follow it.  But, there ARE ways to minimize issues, and I could even argue an answer to every point you bring up, but I won't; you didn't address anything to me, and this is unsolicited advice in a sense, albeit on topic.  

Good luck

Pop



Iain wrote:
> Well the 'item being promoted' is electronic reminders from a
> Government department that tax payments are due, so even if a message
> did have 'content' - You are subscribed to receive tax reminders and
> this is to remind you your tax is now due - I defy even the most
> hardened spam reporter to consider that a message like that is
> selling or promoting something! I know Government departments now
> like to refer to taxpayers as customers, but to consider they are
> 'selling' tax to citizens really is going a bit far :-) 
> 
> No there is no list in pre-existance, this all about how to properly
> allow users to ask to receive tax information - or more likely
> notification there is information available on the web or that they
> need to submit via the 
> web - and then ensuring the mail goes to the right person. The reason
> for all the care about checking the user and wanting as best as we
> can to ensure the Email address being provided is valid, good,
> remains good and and is for the right person, is that it's to do with
> tax compliance. If someone asks to be reminded that their tax is due
> and due to a sloppy list they don't get the reminder, then we don't
> want to get into a legal situation where the person claims their
> non-compliance is because they never got the reminder. 
> 
> Now granted that SMTP isn't the most reliable way of doing things,
> but it's the nearest equivalent to a letter in the mailbox so we have
> to use it. The issue is how to try and make it as reliable as
> possible and as convenient to use. THAT is why I'm so interested in
> making sure we don't get blacklisted either by malicious action of
> someone trying to subscribe a spamtrap to an alert and why I'm so
> interested in what automated actions an ISP might take if, say, a
> block of addresses go invalid because a businesses Email is all
> suspended. You might think that a crazy scenario, but I don't want to
> be the one that explains that the reason some large number of people
> have suddenly stopped paying their tax is because the mail alert
> system has been blacklisted because I didn't think something through.
> So excuse me, I need to be very thorough...I'm not trying to sell
> "Italian Rolexs" (don't these muppets know Rolex is a Swiss company
> anyway?!)  
> 
> So if you'll bear with me, I will have more questions as I try and
> establish 'the best' solution in terms of user convenience and
> experience, avoid a major Government department becoming a spammer
> either due to inadvertent or malicous supply of Email addresses or
> other means yet ensure the 'best' means of ensuring reliable delivery
> of important information over an unreliable carrier :-)
> 
> .../Iain
> 
> 
> "Mike Easter" <MikeE@ster.invalid> wrote in message
> news:cs3mcb$qoi$1@news.spamcop.net...
>> Iain wrote:
>>> So then, the very first Email that is sent as a part of the opt-in
>>> process would under your comments get reported as spam if the user
>>> wasn't expecting it - caused by the original web user giving someone
>>> else's address for whatever reason? That is a no-win situation you
>>> describe as I have no way to test the address provided - ever -
>>> unless I send mail to it!
>> 
>> There are all kinds of spam reporters.  We'll use me as an example. 
>> If I receive an item which is 'purely' confirmatory, not promoting
>> itself or its products or its purpose in any way, and whose entire
>> purpose is to tell me that my address has been entered as desirous
>> of wanting to be on that mailing list -- and, that in order for me
>> to be so subscribed then I must click this link or reply this mail,
>> else the subscription process fails -- then I do not report that as
>> spam.  That non-reportability is aided by my observation that the
>> From of the sender and the source of the confirmatory mail and other
>> elements of the header show no bogosity;  that the item was
>> 'straightup' From = source and nonabusive to any proxies.
>> 
>> OTOH, some spamcop reporters are triggerhappy and kneejerkish.  So,
>> if they get something which they don't recognize, they might spamcop
>> report it.  That is against the spamcop rules which sez to not report
>> confirmatory items.  But, your problem is that if such a spamcop
>> reporter gets your mail, their spamcop notify doesn't provide you
>> with the email address to which you sent the confirmation.  The
>> spamcop reporting process acts as an anonymizer, so you can see a
>> problem developing for your list there.
>> 
>> In addition, if a spamtrap receives your confirmatory mail, then that
>> can cause your mailing list to be named as a spamsource as well.
>> 
>>> "The confirmation mail when someone first subscribes to something
>>> must contain no 'content' other than its own confirmation."
>>> 
>>> So then, if you're the recipient of a message with 'no content' sent
>>> to you because someone else gave your Email address as their own
>>> address, this is going to help you? Surely a message that explains
>>> what it is, why it is being sent to the person and what to do if
>>> they do/do not want it - a 'welcome message' - is a lot better than
>>> something with 'no content'.
>> 
>> Let's be careful about not 'overinterpreting' no content -- just
>> like we must be careful about not misusing 'welcome'.  What I meant
>> by no content was no content which is promoting the item.  Some
>> mailing lists think they can send something out promoting itself and
>> be so convincing that the person they sent it to decides that they
>> want it.  What I mean is no content promoting anything, including
>> itself.  The purpose is for confirmation, not promotion.  Obviously
>> there would be enough 'content' that the person could tell that it
>> was something they had just requested.  There are many ways of doing
>> that without the item promoting itself or being an 'issue' of the
>> mailing list subscription. 
>> 
>> Let us also be careful about this welcome business.  Earlier we were
>> talking about someone being sent a subscription to something
>> welcoming them, telling them how great this item is, in order to
>> convince them to subscribe.  Or to not unsubscribe.  That would be
>> considered a 'promotional' welcome.  When I say no content, I mean
>> no promotional content.  Only confirmatory content.
>> 
>>> My point about addresses 'going invalid', is that just because you
>>> get an opt-in message does not mean the address will be good
>>> forever. It means it was okay and the user wanted it at that time,
>>> but the address may lapse for many reasons. If *the ISP* then
>>> invokes rules about mail being sent to invalid mail addresses you
>>> fall into that problem despite the opt-in.
>> 
>> I can't comment on all of the different kinds of mail managements
>> that recipient ISPs may do.  The ideal situation would be that if
>> you emailed an invalid address that the mail would 'bounce' where
>> bounce means be permanently rejected before transmission;  ie not
>> accepted for delivery. 
>> 
>> Emailing a dead or invalid address is quite a different matter than
>> emailing a spamtrap address.
>> 
>>> So, let's say there's a number of people
>>> all opted-in from a company and then for some reason that company's
>>> Email addresses get suspended, suddenly we'd be sending mail to
>>> multiple invalid addresses.
>> 
>> That's a crazy scenario.  When you use your imagination like that it
>> smells like a dirty list again.
>> 
>>> Yes we need to process 'invalid address'
>>> replies, but we can't do that until we get the bounces and we need
>>> to try all the addresses to know they're all now bad.
>> 
>> Same crazy scenario.  Doesn't make any sense to me.
>> 
>>> I also do not understand your comments about 'a dirty list' when the
>>> whole purpose of posting this is *precisely* to establish the best,
>>> most spam-protected means of allowing users to subscribe for Email
>>> notifications and ensuring that for whatever reason, inadvertent or
>>> malevolent, users cannot sign up someone else to receive Email they
>>> don't want. It is precisely because we're trying to ensure the list
>>> is not only clean but up to date we're going through this exercise!
>> 
>> The reason I mention 'dirty list' is because all to often when
>> someone starts 'worrying about' getting 'balcklisted' ;-) they are
>> worrying because they *have* a list and they are worried about using
>> it.  Anyone who has a list and starts worrying about it almost
>> universally has a dirty list;  that is, they don't have a proper
>> list at all;  so they don't have a list.
>> 
>> If you don't have a list, then you don't have a dirty list.  If you
>> have a list and you're worried about what might happen when you mail
>> to it, then you have a dirty list.
>> 
>> --
>> Mike Easter
>> kibitzer, not SC admin
From Kilgallen at SpamCop.net  Fri Jan 14 12:09:38 2005
From: Kilgallen at SpamCop.net (Larry Kilgallen)
Date: Fri Jan 14 13:10:18 2005
Subject: [SC-Help] Re: Getting balcklisted
References: <cs2o2s$87g$1@news.spamcop.net> <cs35cr$f91$1@news.spamcop.net>
	<cs36d0$ftq$1@news.spamcop.net> <cs3fab$l7e$1@news.spamcop.net>
	<cs3hfj$mpv$1@news.spamcop.net> <cs3jtr$osv$1@news.spamcop.net>
	<cs3mcb$qoi$1@news.spamcop.net> <cs6o2e$nat$1@news.spamcop.net>
	<cs90a6$56o$1@news.spamcop.net>
Message-ID: <jwWa1aiW7hs3@eisner.encompasserve.org>

In article <cs90a6$56o$1@news.spamcop.net>, "Pop" <nobody@spamcop.net> writes:
> From the peanut gallery and purposely top-posted:

Honesty is the best policy since it lets us adjust our browsers immediately.
From ipmarketing at spamcop.net  Fri Jan 14 18:12:03 2005
From: ipmarketing at spamcop.net (Iain)
Date: Fri Jan 14 13:15:04 2005
Subject: [SC-Help] Re: Getting balcklisted
References: <cs2o2s$87g$1@news.spamcop.net> <cs35cr$f91$1@news.spamcop.net>
	<cs36d0$ftq$1@news.spamcop.net> <cs3fab$l7e$1@news.spamcop.net>
	<cs3hfj$mpv$1@news.spamcop.net> <cs3jtr$osv$1@news.spamcop.net>
	<cs3mcb$qoi$1@news.spamcop.net> <cs6o2e$nat$1@news.spamcop.net>
	<cs90a6$56o$1@news.spamcop.net>
Message-ID: <cs921n$6ro$1@news.spamcop.net>

"Pop" <nobody@spamcop.net> wrote in message 
news:cs90a6$56o$1@news.spamcop.net...

> IMO, your response is more of a statement that you intend to do it your 
> way regardless, as opposed to an open mind trying to get  a head around 
> the issues in a way you can deal with them.


Sorry you read it that way, however if I intended to do it 'my 
way' -whatever that might be - there'd be not point in posting originally. 
My reason for exploring the issues is I need not only to be sure in my own 
mind, but convince a large Government body to do it the way I suggest and 
not to cut corners which others will suggest. I therefore need to think 
through every issue and have an answer for every question else they - not 
me - will do it *their* way. It's not my development budget, it's theirs, 
and I need to be clear about why they must include certain steps and 
probably spend more money. I need a complete and convincing case for why 
they can't do it as being proposed by the 'marketing guys' - and yes, 
Government tax departments do have people they refer to as 'marketing' - 
people trying to encourage online service take-up - hence 'welcome messages' 
and hassle-free (as *they* see it) subscription options.

Personally I'm finding the discussion with Mike *extremely* helpful. I still 
have more issues to explore and can only hope he and others will be kind 
enough to continue to provide me their own views and lessons of experience.

.../Iain 


From ipmarketing at spamcop.net  Fri Jan 14 18:21:07 2005
From: ipmarketing at spamcop.net (Iain)
Date: Fri Jan 14 13:25:05 2005
Subject: [SC-Help] Re: Getting balcklisted
References: <cs2o2s$87g$1@news.spamcop.net> <cs35cr$f91$1@news.spamcop.net>
	<cs36d0$ftq$1@news.spamcop.net>
	<mailman.61.1105545498.4572.spamcop-help@news.spamcop.net>
	<cs3i7e$nio$1@news.spamcop.net> <TYh57xdb8UDY@eisner.encompasserve.org>
	<cs6op4$o6i$1@news.spamcop.net> <8vTwXmsuJqaA@eisner.encompasserve.org>
Message-ID: <cs92in$77q$1@news.spamcop.net>

"John E. Malmberg" <wb8tyw@qsl.network> wrote in message 
news:8vTwXmsuJqaA@eisner.encompasserve.org...
> In article <cs6op4$o6i$1@news.spamcop.net>,
>   "Iain" <ipmarketing@spamcop.net> writes:

> If you want to stop phishing, all you have to do is to get the anti-spam
> laws in your country modified to hold the ISP hosting the spammer or 
> allowing
> the insecure system to relay spam responsible if they do not take action 
> in
> what should be a reasonable amount of time after notification should have
> been able to be delivered to them.
>

If only it were this simple. There are strong laws about phishing here and I 
have been involved in some activities that have resulted in people involved 
in on-line fraud being jailed, but sadly most phishing scams typically 
originate from Russia and are often hosted either in Eastern Europe of 
China. Having strong laws here does little - the Internet is international. 
Also, there are laws about not robbing banks, but it doesn't stop people 
trying :-(

We could try and lock up the ISPs but that does smack a bit of shooting the 
postman because you don't like the junkmail he brings you. Of course 
electronic blocking is easier but can only occur after the flood starts and 
so far as I  know no one has yet suggested we lock up ISPs for distributing 
viruses which seems a similar 'crime'. I have must sympathy for the ISPs who 
have to cope with these floods and ever burdensome legal requirement to keep 
records of customer use for ever increasing periods of time.

So in the absence of being able to expect the ISPs to block everything 
malicious I have to think about how to defeat such schemes :-)

.../Iain 


From honey.pot at laposte.net  Fri Jan 14 23:10:52 2005
From: honey.pot at laposte.net (honey.pot@laposte.net)
Date: Fri Jan 14 17:10:02 2005
Subject: [SC-Help] honey.pot@laposte.net
Message-ID: <41e84230$0$6611$8fcfb975@news.wanadoo.fr>

honey.pot@laposte.net
From bounce at bounce.com  Fri Jan 14 14:25:47 2005
From: bounce at bounce.com (Don J. Reid)
Date: Fri Jan 14 17:30:04 2005
Subject: [SC-Help] WorldPath?
Message-ID: <cs9h1a$gop$1@news.spamcop.net>

I received the below from WorldPath today, I have never hear of ektron . 
com, never opted in ect.

It has been pounded into me threw the newsgroups not to respond to opt out 
on e-mails are these people legit?

--
Hello SpamCop user,

We do not consider this email to be spam as they have an option to remove 
yourself from further receipts of this email.
Thank you.

Network Abuse Department
WorldPath Internet Services
-- 
Please use the link below to review the report in question:
http://www.spamcop.net/mcgi?action=showhistory;slice=reportid;val=1336849486



-- 
Thanks in advance.

Don J. Reid 


From nobody at devnull.spamcop.net  Fri Jan 14 16:57:49 2005
From: nobody at devnull.spamcop.net (WazoO)
Date: Fri Jan 14 18:00:04 2005
Subject: [SC-Help] Re: WorldPath?
References: <cs9h1a$gop$1@news.spamcop.net>
Message-ID: <cs9ipe$hpe$1@news.spamcop.net>

"Don J. Reid" <bounce@bounce.com> wrote in message
news:cs9h1a$gop$1@news.spamcop.net...
> I received the below from WorldPath today, I have never hear of ektron .
> com, never opted in ect.
>
> It has been pounded into me threw the newsgroups not to respond to opt out
> on e-mails are these people legit?

  This isn't an opt-in/out e-mail.  It appears to be an ISP response
to one of your spam complaints.

> Please use the link below to review the report in question:
>
http://www.spamcop.net/mcgi?action=showhistory;slice=reportid;val=1336849486

Are these yours?


From wb8tyw at qsl.network  Fri Jan 14 17:59:21 2005
From: wb8tyw at qsl.network (John E. Malmberg)
Date: Fri Jan 14 18:00:18 2005
Subject: [SC-Help] Re: Getting balcklisted
In-Reply-To: <cs92in$77q$1@news.spamcop.net>
References: <cs2o2s$87g$1@news.spamcop.net> <cs35cr$f91$1@news.spamcop.net>
	<cs36d0$ftq$1@news.spamcop.net>
	<mailman.61.1105545498.4572.spamcop-help@news.spamcop.net>
	<cs3i7e$nio$1@news.spamcop.net> <TYh57xdb8UDY@eisner.encompasserve.org>
	<cs6op4$o6i$1@news.spamcop.net> <8vTwXmsuJqaA@eisner.encompasserve.org>
	<cs92in$77q$1@news.spamcop.net>
Message-ID: <cs9isa$hq0$1@news.spamcop.net>

Iain wrote:

 > We could try and lock up the ISPs but that does smack a bit of
 > shooting the postman because you don't like the junkmail he brings
 > you. Of course

No, it is more like the ISP in this case is knowingly allowing a crime 
to be committed and is pretending that they can do nothing about it, and 
trying to convince you that is the case.

In these cases the ISP's are aware that a crime is being committed with 
their resources, and they can easily stop the crime if they choose.
If they are not aware of the crime, it means that they do not have the 
basic competency needed to provide the product that they are selling, 
and that is fraud.

The only reason that the criminal activity on their networks is allowed 
to persist is that the ISP's have decided it costs less to just bill 
their customers more than to run a quality network.

To put it back to your postman analogy, it would be a case of the 
postman knowing that criminals are putting in illegal drugs in his bag 
at one end of the route, and then taking them out at the other end to 
avoid a policeman in the middle.  And even though this postman is not 
getting paid to be a mule, would you consider them innocent of the crime?

This is what the case is when there is an open proxy on an ISP's network 
and they know about it.

> I have must sympathy for the ISPs who 
> have to cope with these floods and ever burdensome legal requirement to keep 
> records of customer use for ever increasing periods of time.

The only time that ISP's are hit with these floods and if they last more 
than a few minutes is when they do not have technical staff that 
understands how to deal with the normal problems that are expected to occur.

When an ISP is hosting a phishing site, and can not shut it down with in 
5 minutes of the abuse report reaching their inbox, they are 
demonstrating that they to not have the basic minimum competency to do 
their jobs.

If your nation is dependent on a working electronic infrastructure, you 
need to start holding the providers of that infrastructure accountable 
to be qualified to do their jobs.

As the broadband suppliers in most areas have a virtual monopoly, they 
have no incentive to provide a quality product, and it shows.

Once you find out how a competent network is run, you will find that 
they are spending less money on larger operations than the ISP's that 
are complaining that the task of dealing with these problems are too 
hard for them.

-John
wb8tyw@qsl.network
Personal Opinion Only
From wb8tyw at qsl.network  Fri Jan 14 18:03:46 2005
From: wb8tyw at qsl.network (John E. Malmberg)
Date: Fri Jan 14 18:05:03 2005
Subject: [SC-Help] Re: WorldPath?
In-Reply-To: <cs9h1a$gop$1@news.spamcop.net>
References: <cs9h1a$gop$1@news.spamcop.net>
Message-ID: <cs9j4i$i77$1@news.spamcop.net>

Don J. Reid wrote:
> I received the below from WorldPath today, I have never hear of ektron . 
> com, never opted in ect.
> 
> It has been pounded into me threw the newsgroups not to respond to opt out 
> on e-mails are these people legit?

It is a violation of the terms of use for my primary e-mail provider for 
me to opt out of something that I did not opt in to.

That provider when presented with a persistent spammer, will however 
consider putting in a local block on the sending I.P. range.

Consider having a chat with other customers of your e-mail provider.

-John
wb8tyw@qsl.network
Personal Opinion Only
From bounce at bounce.com  Fri Jan 14 16:18:22 2005
From: bounce at bounce.com (Don J. Reid)
Date: Fri Jan 14 19:25:02 2005
Subject: [SC-Help] Re: WorldPath?
References: <cs9h1a$gop$1@news.spamcop.net> <cs9ipe$hpe$1@news.spamcop.net>
Message-ID: <cs9nkk$kup$1@news.spamcop.net>


"WazoO" <nobody@devnull.spamcop.net> wrote in message 
news:cs9ipe$hpe$1@news.spamcop.net...
> "Don J. Reid" <bounce@bounce.com> wrote in message
> news:cs9h1a$gop$1@news.spamcop.net...
>> I received the below from WorldPath today, I have never hear of ektron .
>> com, never opted in ect.
>>
>> It has been pounded into me threw the newsgroups not to respond to opt 
>> out
>> on e-mails are these people legit?
>
>  This isn't an opt-in/out e-mail.  It appears to be an ISP response
> to one of your spam complaints.
>
>> Please use the link below to review the report in question:
>>
> http://www.spamcop.net/mcgi?action=showhistory;slice=reportid;val=1336849486
>
> Are these yours?
>
>

Sorry, I guess my question should have been.

I revived a response back form a e-mail that I reported to spamcop it came
back from the abuse desk @ WorlPath with the note,

"We do not consider this email to be spam as they have an option to remove
yourself from further receipts of this email."

I guess, I just wanted to know if WorlPath is a spam source and if I should
follow up with them or just ignore it and keep reporting ektron . com spam
in the future.

Don


From MikeE at ster.invalid  Fri Jan 14 16:37:18 2005
From: MikeE at ster.invalid (Mike Easter)
Date: Fri Jan 14 19:40:05 2005
Subject: [SC-Help] Re: WorldPath?
References: <cs9h1a$gop$1@news.spamcop.net>
Message-ID: <cs9ogm$lno$1@news.spamcop.net>

Don J. Reid wrote:
> I received the below from WorldPath today, I have never hear of
> ektron . com, never opted in ect.

I don't know what ektron has to do with the issue.  There isn't much
information here.

> It has been pounded into me threw the newsgroups not to respond to
> opt out on e-mails are these people legit?

You are correct;  you should not be opting out to anything which you
didn't opt into;  especially under certain circumstances;  but we aren't
privvy to any circumstances here.

> Hello SpamCop user,
>
> We do not consider this email to be spam as they have an option to
> remove yourself from further receipts of this email.
> Thank you.
>
> Network Abuse Department
> WorldPath Internet Services

Because we aren't privvy to the circumstances, we don't know whether
worldpath is way outawhack or just sorta outawhack.  Worldpath
apparently believes their client and not you.  Whether that is
appropriate or not is not determinable from the information before us.

> Please use the link below to review the report in question:
www.spamcop.net/mcgi?action=showhistory;slice=reportid;val=1336849486

That link doesn't show me the issue;  it only shows me that a report
went to worldpath about 64.140.213.170  rDNS
WPIS-64-140-213-170.worldpath.net  which must've been about a
spamvertiser, because if it had been about a source, I would've been
able to see the spam.

If we knew the circumstances and had decided that worldpath was so far
outawhack that they should be 'reported' to their upstream providers in
the form of upstream adjacencies, we would note that worldpath is AS3770

Upstream Adjacent AS list
    AS174     COGENT Cogent/PSI  = abuse@cogentco.com
    AS3549    GBLX Global Crossing Ltd. = abuse@gblx.net

and, you would include the original item, along with their response to
your notify, and you would include in the To: worldpath and the two
upstreams.


-- 
Mike Easter
kibitzer, not SC admin

From TJLWBECGSGWU at spammotel.com  Sat Jan 15 01:11:59 2005
From: TJLWBECGSGWU at spammotel.com (Mathew Hendry)
Date: Fri Jan 14 20:15:03 2005
Subject: [SC-Help] Re: WorldPath?
References: <cs9h1a$gop$1@news.spamcop.net> <cs9ipe$hpe$1@news.spamcop.net>
	<cs9nkk$kup$1@news.spamcop.net>
Message-ID: <04rgu05qrg85th1dh7cu9g5dsniuhcmdc6@4ax.com>

On Fri, 14 Jan 2005 16:18:22 -0800, "Don J. Reid" <bounce@bounce.com> wrote:

>I guess, I just wanted to know if WorlPath is a spam source and if I should
>follow up with them or just ignore it and keep reporting ektron . com spam
>in the future.

They've been SPEWS listed within the past month.

http://www.spews.org/html/S2923.html

AT&T claim to have kicked them off per

http://groups.google.co.uk/groups?selm=1104425671.805497.78570%40z14g2000cwz.googlegroups.com

-- Mat.

From nobody at spamcop.net  Fri Jan 14 20:27:56 2005
From: nobody at spamcop.net (Pop)
Date: Fri Jan 14 20:30:02 2005
Subject: [SC-Help] Re: Getting balcklisted
References: <cs2o2s$87g$1@news.spamcop.net> <cs35cr$f91$1@news.spamcop.net>
	<cs36d0$ftq$1@news.spamcop.net> <cs3fab$l7e$1@news.spamcop.net>
	<cs3hfj$mpv$1@news.spamcop.net> <cs3jtr$osv$1@news.spamcop.net>
	<cs3mcb$qoi$1@news.spamcop.net> <cs6o2e$nat$1@news.spamcop.net>
	<cs90a6$56o$1@news.spamcop.net> <cs921n$6ro$1@news.spamcop.net>
Message-ID: <cs9rir$nnf$1@news.spamcop.net>

Iain wrote:
> "Pop" <nobody@spamcop.net> wrote in message
> news:cs90a6$56o$1@news.spamcop.net...
> 
>> IMO, your response is more of a statement that you intend to do it
>> your way regardless, as opposed to an open mind trying to get  a
>> head around the issues in a way you can deal with them.
> 
> 
> Sorry you read it that way, however if I intended to do it 'my
> way' -whatever that might be - there'd be not point in posting
...
> I still have more issues to explore and can only hope he and others
> will be kind enough to continue to provide me their own views and
> lessons of experience. 
> 
> .../Iain

And, it looks like I owe you an apology.  I am sorry and I apologize for my statements.  No good excuse for my actions other than momentary loss of lucidity, apparently.  I placed too much emphasis on an intial para you wrote and not enough on the remaining paras.  It's called income pleet compry hension!  My bad.

Pop

From MikeE at ster.invalid  Fri Jan 14 17:32:07 2005
From: MikeE at ster.invalid (Mike Easter)
Date: Fri Jan 14 20:35:03 2005
Subject: [SC-Help] Re: WorldPath?
References: <cs9h1a$gop$1@news.spamcop.net> <cs9ipe$hpe$1@news.spamcop.net>
	<cs9nkk$kup$1@news.spamcop.net> <04rgu05qrg85th1dh7cu9g5dsniuhcmdc6@4ax.com>
Message-ID: <cs9rng$nu7$1@news.spamcop.net>

Mathew Hendry wrote:
> "Don J. Reid"
>> I guess, I just wanted to know if WorlPath is a spam source and if I
>> should follow up with them or just ignore it and keep reporting
>> ektron . com spam in the future.
>
> They've been SPEWS listed within the past month.
>
> http://www.spews.org/html/S2923.html
>
> AT&T claim to have kicked them off per
>
>
http://groups.google.co.uk/groups?selm=1104425671.805497.78570%40z14g2000cwz.googlegroups.com

If you are going to talk about those issues;  you should talk about the
whole issue [I'm not in the business of defending worldpath, but let's
be thorough here]:

Here's the spews S2923 issue about wonderpopup

WonderPopUp
|--------------------
1, 206.152.191.2, wonderpopup.com / www.wonderpopup.com
2, 206.152.191.0/24, worldpath.net (wonderpopup.com /
www.wonderpopup.com) (C&W)
1, 209.187.114.211, www.offers.wonderpopup.com / offers.wonderpopup.com
1, 209.187.114.130, youdontknowwhoiam.org
1, 209.187.114.132, clitical.com
1, 209.187.114.0/24, worldpath.net (wonderpopup.com) (ATT)

The bottom block shows 3 different issues, at .211, .130, and .132 which
led to a /24 block getting listed as a 1, -- but, here's the current
situation with the 209.187

whois -h whois.arin.net 209.187.114.132 ...
OrgName:    CERFnet
NetRange:   209.186.0.0 - 209.187.255.255
Contact AT&T Abuse ( abuse@att.net ) for policy abuse issues

The top block shows spews 'threatening' worldpath's /24 with a 2,
because of wonderpopup at 206.152.191.2

But, if I look at the DNS for wonderpopup now I see 204.251.15.167 which
is in a structure which has nothing to do with worldpath

whois -h whois.arin.net 204.251.15.167 ...
Sprint  204.248.0.0 - 204.251.255.255
Datasync Internet Services  204.251.0.0 - 204.251.15.255
Zipa,  204.251.7.0 - 204.251.15.255

So, one might assume that worldpath got rid of wonderpopup.  And your
newsgroup link which sez that ATT got rid of worldpath doesn't really
show up in these current whois results.

When you look at worldpath in terms of the IP in question here,

whois -h whois.arin.net 64.140.213.170 ...
OrgName:    WorldPath Internet Services
NetRange:   64.140.192.0 - 64.140.223.255

that /19 is not listed anywere important;  except that the IP itself is
SCbl listed as a spamsource and for hitting spamtraps;  but that sounds
like a different kind of issue than we are discussing here about some
spamvertiser.


-- 
Mike Easter
kibitzer, not SC admin

From ipmarketing at spamcop.net  Sat Jan 15 11:53:21 2005
From: ipmarketing at spamcop.net (Iain)
Date: Sat Jan 15 06:55:26 2005
Subject: [SC-Help] Re: Getting balcklisted
References: <cs2o2s$87g$1@news.spamcop.net> <cs35cr$f91$1@news.spamcop.net>
	<cs36d0$ftq$1@news.spamcop.net> <cs3fab$l7e$1@news.spamcop.net>
	<cs3hfj$mpv$1@news.spamcop.net> <cs3jtr$osv$1@news.spamcop.net>
	<cs3mcb$qoi$1@news.spamcop.net> <cs6o2e$nat$1@news.spamcop.net>
	<cs90a6$56o$1@news.spamcop.net> <cs921n$6ro$1@news.spamcop.net>
	<cs9rir$nnf$1@news.spamcop.net>
Message-ID: <csb07q$d2c$1@news.spamcop.net>

No offence taken :-)

Just trying to make sure I do a good job if this. I don't want to be back 
here in some months time explaining about how this large Government 
department keeps getting blacklisted :-)

.../Iain



"Pop" <nobody@spamcop.net> wrote in message 
news:cs9rir$nnf$1@news.spamcop.net...


And, it looks like I owe you an apology.  I am sorry and I apologize for my 
statements.  No good excuse for my actions other than momentary loss of 
lucidity, apparently.  I placed too much emphasis on an intial para you 
wrote and not enough on the remaining paras.  It's called income pleet 
compry hension!  My bad.

Pop


From ipmarketing at spamcop.net  Sat Jan 15 12:01:54 2005
From: ipmarketing at spamcop.net (Iain)
Date: Sat Jan 15 07:05:04 2005
Subject: [SC-Help] Re: Getting balcklisted
References: <cs2o2s$87g$1@news.spamcop.net> <cs35cr$f91$1@news.spamcop.net>
	<cs36d0$ftq$1@news.spamcop.net>
	<mailman.61.1105545498.4572.spamcop-help@news.spamcop.net>
	<cs3i7e$nio$1@news.spamcop.net> <TYh57xdb8UDY@eisner.encompasserve.org>
	<cs6op4$o6i$1@news.spamcop.net> <8vTwXmsuJqaA@eisner.encompasserve.org>
	<cs92in$77q$1@news.spamcop.net> <cs9isa$hq0$1@news.spamcop.net>
Message-ID: <csb0nq$ddi$1@news.spamcop.net>

But John, the phishing site is never hosted here or anywhere where a legal 
agency can get to it, they're always out in the 'lawless East' and run often 
by Russian mafia. There is no complicit ISP to hand, just your poor ISP who 
delivers the mail. It's often not easy to even go to an upstream ISP either 
because of the site's location.

However, better use of blocking lists and sharing of 'spam signatures' 
between ISPs would help enormously as phishing is usually conducted on spam 
lists and just blasted out in the hope of finding a few people that may 
respond. In that respect good filtering would cut down the number of 
messages delivered, but then we all know that effective control of spam 
isn't that easy...which is why SpamCop exists and this group is here. By the 
time people start receiving and complaining about the messages a few million 
have been delivered :-(

.../Iain


"John E. Malmberg" <wb8tyw@qsl.network> wrote in message 
news:cs9isa$hq0$1@news.spamcop.net...
> Iain wrote:
>
> When an ISP is hosting a phishing site, and can not shut it down with in 5 
> minutes of the abuse report reaching their inbox, they are demonstrating 
> that they to not have the basic minimum competency to do their jobs.
> 


From Kilgallen at SpamCop.net  Sat Jan 15 09:49:13 2005
From: Kilgallen at SpamCop.net (Larry Kilgallen)
Date: Sat Jan 15 10:50:21 2005
Subject: [SC-Help] Re: Getting balcklisted
References: <cs2o2s$87g$1@news.spamcop.net> <cs35cr$f91$1@news.spamcop.net>
	<cs36d0$ftq$1@news.spamcop.net>
	<mailman.61.1105545498.4572.spamcop-help@news.spamcop.net>
	<cs3i7e$nio$1@news.spamcop.net> <TYh57xdb8UDY@eisner.encompasserve.org>
	<cs6op4$o6i$1@news.spamcop.net> <8vTwXmsuJqaA@eisner.encompasserve.org>
	<cs92in$77q$1@news.spamcop.net> <cs9isa$hq0$1@news.spamcop.net>
	<csb0nq$ddi$1@news.spamcop.net>
Message-ID: <kidzD+nE4y7f@eisner.encompasserve.org>

In article <csb0nq$ddi$1@news.spamcop.net>, "Iain" <ipmarketing@spamcop.net> writes:

> But John, the phishing site is never hosted here or anywhere where a legal 

Please stop top-posting.
From wb8tyw at qsl.network  Sat Jan 15 10:57:30 2005
From: wb8tyw at qsl.network (John E. Malmberg)
Date: Sat Jan 15 11:00:02 2005
Subject: [SC-Help] Re: Getting balcklisted
In-Reply-To: <csb0nq$ddi$1@news.spamcop.net>
References: <cs2o2s$87g$1@news.spamcop.net> <cs35cr$f91$1@news.spamcop.net>
	<cs36d0$ftq$1@news.spamcop.net>
	<mailman.61.1105545498.4572.spamcop-help@news.spamcop.net>
	<cs3i7e$nio$1@news.spamcop.net> <TYh57xdb8UDY@eisner.encompasserve.org>
	<cs6op4$o6i$1@news.spamcop.net> <8vTwXmsuJqaA@eisner.encompasserve.org>
	<cs92in$77q$1@news.spamcop.net> <cs9isa$hq0$1@news.spamcop.net>
	<csb0nq$ddi$1@news.spamcop.net>
Message-ID: <csbeha$led$1@news.spamcop.net>

Iain wrote:
> But John, the phishing site is never hosted here or anywhere where a legal 
> agency can get to it, they're always out in the 'lawless East' and run often 
> by Russian mafia. There is no complicit ISP to hand, just your poor ISP who 
> delivers the mail. It's often not easy to even go to an upstream ISP either 
> because of the site's location.

You are still missing the point, and need to learn quite a bit more 
about how the spamming operations work.

The phish is not sent from the ISP hosting the site, because the phisher 
knows that most of the well run ISP's are no longer accepting e-mail 
from that network, or in the rare cases where mail is still being 
accepted from that site, if they send a spam directly from the site, it 
will cause the same ISP's to block the e-mail from the site, which would 
force the server owner to take immediate action against them.

The phish it is sent through an zombie computer, usually one that has 
been known to be a zombie computer for several days by the ISP that is 
providing connectivity to it.

[Back when spamcop.net made evidence available to the general public, 
this was very easy to verify]

And these ISP's are usually the residential ISP's, in your country and 
mine included.  And this is easy to verify by evidence posted on the 
public internet.

You will find that about 1/2 of the spam and phish are relayed from 
sources that it is quite easy to get a law enforcement officer to if you 
could sufficiently motivate one to do so.

Your government may not be able to do anything about the networks 
outside of your country, however if an ISP in your country leaves a 
zombie computer connected to the internet for more than one business 
day, they are demonstrating that they to not have the knowledge on how 
to deliver the service that they have sold to their customers, and they 
are committing fraud to both their stock holders and their customers.

By their inaction they are knowing letting their networks be used for a 
crime, and in fact they are subsidizing the crime in lost profits, and 
in issuing refunds to the customer's whose internet access is 
effectively shut down because of the bandwidth being stolen.  Seems 
stupid doesn't it?  But they just issue a rate increase to cover the cost.

What needs to be done is to stop having pity on ISP's having problems 
that they have caused by their own incompetence, or letting them make 
phony excuses.

Start studying the proxypot project.  What that is is anti-spam 
operators that have set up what looks like open proxies, and then they 
record who tries to steal bandwidth from them.  Then they report the 
sources of them.  Usually you will find plenty of sources in your own 
country.  The proxy pot project directly identifies the ISP that the 
criminals are using and paying.  When an ISP does nothing about their 
customer that is hitting a proxypot, then that ISP is ignoring criminal 
activity by their customer.

And guess what, anyone can operate a proxypot, including your government.

These reports show that the operators of the spam and phishing sites are
usually located in countries like yours and mine.

Again, what is being found in the U.S., the U.K. and other countries is 
that many of the broadband ISP's are well aware of the criminal activity 
of their customers, and have willfully decided to do nothing as long as 
they think that the customer's bill is eventually going to be paid.

That basically gets back to this:

A country's anti-spam laws must hold ISP's responsible for any criminal 
activity on their network that they should be aware of and did not stop 
in a reasonable amount of time from that point.

Anything less than that is almost toothless.  And the law must also be 
enforced.

And a very lenient technical standard for this is that all such activity 
should stop with in one business day of a notice sent to either the 
abuse or postmaster e-mail address on their network.

Be aware that a competent network operator would be embarrassed if it 
took them more than 15 minutes to locate and shut off an abuser on their 
network.

It is also the only way to stop the phishers that are located in your 
country.

Once these scammers are caught, they are not usually located in the 
other countries, they are actually located in your country and mine, and 
that the ISP providing them primary connectivity to their home or 
business had received more than enough complaints to be aware that their 
customers were up to a criminal operation.

Even more curious, the scammers usually leave the ISP with an unpaid 
bill of over $2,000 U.S. and then declare bankruptcy.  I do not think my 
ISP would allow me to get that far in arrears, so how can these scammers 
get so far in arrears with out the assistance at someone at the ISP?

It is just that currently no one is holding ISP's responsible for not 
stopping a crime that they know to be in progress, so they just collect 
the money.

If the law held the ISP responsible for stopping a criminal activity 
that it should know to be being committed, this would force the scammers 
into having to be physically located in those other countries, instead 
of being nice and comfortable in your country and mine.

Right now the laws give the scammers a safe haven in your country and 
mine as long as their hosting ISP is willing to look the other way.

About 1/3 of the drug spams that are getting through to me are showing 
up as being hosted by one specific U.S. ISP.

At least 1/4 of the Nigerian 419 scams that are getting to me are coming 
through two British ISP's that are allowing anonymous senders to forge 
headers through their web mailers.  This is a security misconfiguration 
that has existed on those web mailers for at least 4 months now.
Why has not the ISP's taken action to stop this?  Other ISP's have web 
mailers and they have no problem keeping these scammers away.

Readers in the U.S. should be aware that it is very easy for you to find 
a toll free phone number for your elected representative.  A phone call 
ties up a physical staff member, unlike e-mail and snail mail that is 
more easily responded to with a bed-bug letter.

Also the network addresses that ISP's are willing to host spam and phish 
sites are usually listed in the sbl.spamhaus.org.  If ISP's would block 
all traffic from those sites, the it would make the phish sites 
invisible to their customers.

And it is highly likely that the only thing that the customers would 
notice is that most of the pictures in the spam would no longer show up.


 >However, better use of blocking lists and sharing of 'spam signatures'
> between ISPs would help enormously as phishing is usually conducted on spam 
> lists and just blasted out in the hope of finding a few people that may 
> respond. In that respect good filtering would cut down the number of 
> messages delivered, but then we all know that effective control of spam 
> isn't that easy...which is why SpamCop exists and this group is here. By the 
> time people start receiving and complaining about the messages a few million 
> have been delivered :-(

Effective control of spam is actually easy.  It is clouded by too many 
people that do not understand the issue and are.  Once you sort out the 
stuff that does not work and start looking at the stuff that works, the 
issues become really clear and are not really very complex technically.

Spam signatures do not work, and neither does most content analysis, and 
the concentration of those methods are one of the things that is 
assisting the spammers.  It is also confusing the issue because they are 
what are advertised as being state of the art.  They are not.
Spam changes to fast for spam signatures to work, and only one content 
filtering method has shown to be effective, but it is only known to be 
implemented in SpamAssasin 3.0.

And content filtering more than triples the cost of operating a mail server.

 From 80% to 95% of the spam sources are now in conservative blocking 
lists, and show up in them with in seconds of a spam run.
These can be safely blocked at the mail server with out risk of 
rejecting a real e-mail, and about 99% of all the mail servers in 
commercial use are able to do this.

Doing so also significantly lowers the cost of operating the mail server.

Almost all of the rest of the spam will have a significant defect in 
it's headers or will be listed in an aggressive blocking list like 
spamcop.net, spews.org, or one of the multi-hop lists.  Of those, almost 
all the ones of those that are really spam with have a URL that either 
does not resolve, or resolves to an I.P. address listed in the 
sbl-bl.spamhaus.org.  While that combined check will not catch 100% of 
the spam, it should pass any real e-mail that is coming through.

Steve Linford, an internationally recognized expert on spam control is 
reporting that UXN.COM is reporting 100% success in using a procedure 
similar to that, and unlike many ISP's they are not directly blocking 
mail from DHCP addresses.

Currently Only SpamAssasin 3.0 is known to be able to make that combined 
check.  And not all commercial mail servers can do this check before the 
SMTP transaction is over.

Even though this effective anti-spam algorithm has been well known on 
the internet for more than a year, and has proved it self to be 
effective, it does not appear to have been adopted by any of the 
commercial anti-spam products.

You will also find that network addresses that are willing to host the 
phish sites are usually already listed in the sbl-bl.spamhaus.org.


I see almost no complaints of problems with mail servers that primarily 
use DNS based blocking lists as an anti-spam measure, and they have 
excellent uptime.

For the mail servers that primarily use content filtering, or accept all 
e-mail and spam and then attempt to sort it out, I see lots of 
complaints from their users.  Usually a lot of spam gets through, and a 
lot of real mail is silently deleted, and there are usually a lot of 
complaints about the mail servers not working.

And to provide this poorer service, those mail servers operators that 
the people are complaining about are typically spending much more 
operating cash than the well run ones.  Even when the well run mail 
server is a larger operation.


The fact is that an I.P. address that allows spam or viruses to be sent 
does not send any real mail, or does not for long.

That is because many ISP's, and some of them very large, will use local 
blocking lists to cut off an I.P. address at the first reported spam 
from it.  When a commercial ISP's main mail servers are hit by this, 
they usually react quickly to shut off the multihop relay.  However they 
do not care if their DHCP addresses are in the local block lists.

The fastest way to get spam under control is for ISP's to cut off all 
connectivity to other ISP's that permit spam to be hosted or sent.

Based on the past experiences of ISP's who have done that, the isolated 
ISP complains about how unfair it is for 24 hours, along with how 
impossible it is for them to do anything about their thousands of zombie 
computers for another 24 hours.  After 72 hours, all traces of spam are 
gone from the ISP, as it has figured out how to do the impossible, and 
the ISP finds that other networks will accept packets from it.

Now ISP's have shown over and over again when they are threatened with a 
block by a larger ISP that they can shut off thousands of zombie 
computers in a few hours or less.

Which means that an ISP should never have a problem with a law that 
requires them to remove known criminal activity on their networks with 
in one business day of a report attempted to be mailed to their abuse or 
postmaster mail boxes.

Be aware that some ISP's have automated the procedure to run a security 
scan of on the reported infected computer as soon as a report hits their 
mail box.  They find that isolates the zombie faster, and that both 
saves them operating cash and prevents outages to their other paying 
customers.

Have you ever watched the U.S. TV show "Green Acres"?  The ISP's that 
can not remove reported criminal activity from their network in less 
than a business day are operating like the Hooterville phone company as 
compared to what should be the normal operation of a phone company.

Would your country's citizens put up with a phone company that operated 
the way the one does on "Green Acres"?  Then why allow the suppliers of 
what is becoming a critical electronic infrastructure to do so?

-John
wb8tyw@qsl.network
Personal Opinion Only
From ipmarketing at spamcop.net  Sat Jan 15 20:14:48 2005
From: ipmarketing at spamcop.net (Iain)
Date: Sat Jan 15 15:15:03 2005
Subject: [SC-Help] Re: Getting balcklisted
References: <cs2o2s$87g$1@news.spamcop.net> <cs35cr$f91$1@news.spamcop.net>
	<cs36d0$ftq$1@news.spamcop.net>
	<mailman.61.1105545498.4572.spamcop-help@news.spamcop.net>
	<cs3i7e$nio$1@news.spamcop.net> <TYh57xdb8UDY@eisner.encompasserve.org>
	<cs6op4$o6i$1@news.spamcop.net> <8vTwXmsuJqaA@eisner.encompasserve.org>
	<cs92in$77q$1@news.spamcop.net> <cs9isa$hq0$1@news.spamcop.net>
	<csb0nq$ddi$1@news.spamcop.net> <csbeha$led$1@news.spamcop.net>
Message-ID: <csbtk3$ubg$1@news.spamcop.net>

"John E. Malmberg" <wb8tyw@qsl.network> wrote in message 
news:csbeha$led$1@news.spamcop.net...

> The phish it is sent through an zombie computer, usually one that has been 
> known to be a zombie computer for several days by the ISP that is 
> providing connectivity to it.
>
Okay yes I quite take you point. Stopping the ISPs allowing zomies to be 
hosted would help *a lot*.


> And guess what, anyone can operate a proxypot, including your government.
>
True, although sadly outside the scope of my project, but I'm sure you'll 
sensibly make the point that while everyone says 'not my problem', the 
problem will continue. I agree, but sadly it's not my money and I know I'll 
not get agreement to a proxypot.


> Once these scammers are caught, they are not usually located in the other 
> countries, they are actually located in your country and mine, ...

In the cases I've been involved in, the phishers were also located in Russia 
although that didn't stop their arrest. But it's *a lot* more complex to 
arrange. That's why the phisher work that way.

You make some very sound cases re spam and I only wish I were in a position 
to do more about it. I'll ponder, but don't see any way I can get these 
points to the right audience :-(

.../Iain 


From no at no.spam  Sun Jan 16 14:38:50 2005
From: no at no.spam (Michael Wise)
Date: Sun Jan 16 17:40:34 2005
Subject: [SC-Help] Re: honey.pot@laposte.net
References: <41e84230$0$6611$8fcfb975@news.wanadoo.fr>
Message-ID: <no-4AA270.14384516012005@news.cesmail.net>

In article <41e84230$0$6611$8fcfb975@news.wanadoo.fr>,
 "honey.pot@laposte.net" <honey.pot@laposte.net> wrote:

> honey.pot@laposte.net


laposte.net should worry about cleaning up it's own spam-source problems:

http://www.openrbl.org/ip/81/255/54/11.htm


--Mike
From Amused_2_Death_ at webtv.net  Mon Jan 17 06:15:03 2005
From: Amused_2_Death_ at webtv.net (It's a Miracle)
Date: Mon Jan 17 07:35:02 2005
Subject: [SC-Help] Forced perspective spam
Message-ID: <10808-41EBAC47-160@storefull-3217.bay.webtv.net>

Here's a trick spammers use to fool people into thinking they are
getting child porn. It's a photography trick so it has to be planned
before the picture is taken. 

How many people have seen a forced perspective picture where 2 people
are in a frame. One is at a distance so they are smaller. They are in
the background. Another person is closer to the camera. The person
closest to the camera holds their hand out so the smaller person appears
to be dancing on the palm of their hand. Thats a forced perspective
picture. 

Now here's how you can trick someone into thinking they are getting
child porn. 
Imagine a minor laying on a table.The person laying on the table is
closest. There's another person behind the table with an arm extended
but the forced perspective looks like one minor is fingering the other
but in reality the second minor is actually 3 feet away from the table. 

Here's another example. 2 nudists are in the frame. One older male and a
female minor. The height of the minor when photographed at a certain
angle makes the females mouth appear to be the same height as the males
penis. The female is yawning and the forced perspective looks like a
rape.This example would only be illegal if the male had an erection.It
still wouldn't be pornography but it would be evidence of a Lewd act in
front of a minor which is only a misdemeanor. 

So now you know your not getting child porn but clever forced
perspective pictures. This is what everyone is mad about and it's a
trick. 

The only child porn I ever saw was when "Details" magazine came out they
had a cover story on bodyart with a link to the bodyart
newsgroup.Someone wanted to discredit the magazine so they posted child
porn to blackmail them.Million of dollars was probably at stake so some
idiot posted child porn and wasn't even a pedophile.Probably only a
hacker would think they could get away with it. 

I was watching "cops" and they did arrested a webtver with a camcorder
that did make a website with minors having sex so there are incredibly
stupid people out there but generally the forced perspective psudo-child
porn looks like lawyers reviewed it first. 

Most of it is just tricks.

--
My kaleidoscope art webpage:
http://community-2.webtv.net/Amused_2_Death_/Kaleidoscope/

Keep spam illegitimate, Report spam to:
http://spamcop.net/ 

From ipmarketing at spamcop.net  Mon Jan 17 12:42:14 2005
From: ipmarketing at spamcop.net (Iain)
Date: Mon Jan 17 07:45:03 2005
Subject: [SC-Help] Validating SMTP addresses
Message-ID: <csgbrt$iuv$1@news.spamcop.net>

This message continues from my thread about [avoiding] getting blacklisted - 
<cs35cr$f91$1@news.spamcop.net> - but I thought I'd start afresh as this is 
a slightly different aspect of good list management.

I'm working through how to best validate an address when initially provided 
by a web user and keep informed of the address' status. The checks I'm 
considering are:

1. Well formed, i.e. something@domain.tld
2. Doing an MX check on the domain

This won't tell me it's a valid address, but will tell me if it's invalid.

Various people then claim it's possible to validate an address via SMTP. I'm 
not aware of any explicit function for doing so and presume they refer to 
attempting a MAIL TO: and looking for a <250 ok> reply. I can't see anything 
else and of course those that throw in these 'informed comments' have no 
idea of the detail by which such function could be achieved (a little 
knowledge if a dangerous thing but doesn't stop tham claiming to be 
informed!). I would also presume the vast majority of SMTP servers will not 
allow enumeration of addresses as it simply allows address harvesting. 
Therefore I would presume that actual address verification is impossible 
other than by sending a subscription opt-in message and getting a positive 
reply. Correct?

Of course if the address is then invalid the receiving SMTP server 'may' 
send a bounce message. Now my experience tells me that:

1. There seems to be little consistency to bounce messages

2. I know from discussion of the false non-delivery reports I receive when 
some kind soul uses may mail address to send out spam, that a lot of ISPs 
are smart enough not to send me false non-delivery reports. Therefore I 
wonder what is the likelihood of a bounce message at all? Is the selective 
non-delivery reporting smart enough to reply with NDRs to legitimate 
messages where rDNS and everything else is in order, and simply to suppress 
when a forged header or other suspicious activity is detected?

The use of an explicit subscription opt-in protects against more than one 
initial message being sent to an incorrect address, however my interest in 
bounce messages is what happens when an opted-in address stops working at 
some point in the future. I'd like to be able to intelligently pick up that 
mail is not being delivered as it may be necessary to revert to paper and 
snailmail if important notices aren't being delivered and we're being 
informed of such. So really what this boils down to are views on:

1. The likelihood of ISPs to provide NDRs for 'bad' addresses - or are NDRs 
being suppressed due to them being farmed for spam purposes?

2. The likelihood that any NDR received will be machine readable such that a 
snailmail process could be kicked-off and the user's account marked as now 
having a 'bad' address...so that they can be asked to provide a fresh 
working address at next web login

Thanks for your help.../Iain 


From ric.gates at bigsleep.org  Mon Jan 17 14:44:27 2005
From: ric.gates at bigsleep.org (Blammo)
Date: Mon Jan 17 09:45:02 2005
Subject: [SC-Help] Re: Validating SMTP addresses
References: <csgbrt$iuv$1@news.spamcop.net>
Message-ID: <Xns95E144A99A58Eblammo@216.154.195.61>

On 17 Jan 2005 Iain entered spamcop.help and left
news:csgbrt$iuv$1@news.spamcop.net: 

> 
> I'm working through how to best validate an address when initially
> provided by a web user and keep informed of the address' status. The
> checks I'm considering are:
> 
> 1. Well formed, i.e. something@domain.tld
> 2. Doing an MX check on the domain
> 

There's no reason not to do that, and it's quite easy.
But all that will do is to prevent errors.

> 
> Various people then claim it's possible to validate an address via
> SMTP. I'm not aware of any explicit function for doing so and presume
> they refer to attempting a MAIL TO: and looking for a <250 ok> reply.

Most likely they are talking about VRFY, which is often disabled because of 
abuse. It's probably a bad idea for two reasons; the form submission has to 
wait for this function to finish, which could take quite some time, which 
may cause people to think something is wrong and give up. Second, it 
doesn't validate the address anyway, this doesn't prove it is their address 
or that they didn't make a mistake.

> Therefore I would presume that
> actual address verification is impossible other than by sending a
> subscription opt-in message and getting a positive reply. Correct?
> 

Well, I wouldn't say it's the only possible way, but the only practical 
way.

> Of course if the address is then invalid the receiving SMTP server
> 'may' send a bounce message. Now my experience tells me that:
> ...

I think you mean a Reject 5xx error message? Or is this after the form 
submission is accepted?

> 1. There seems to be little consistency to bounce messages
> 

Well, there should consistancy to Rejects, but bounces are "after the 
fact", Delivery Status Notifications, which should not be sent if there is 
no mailbox by that name. They should only be sent if there is a problem 
with the destination mailbox, or if a DSN reply is requested. 

> 2. I know from discussion of the false non-delivery reports I receive
> when some kind soul uses may mail address to send out spam, that a lot
> of ISPs are smart enough not to send me false non-delivery reports.
> Therefore I wonder what is the likelihood of a bounce message at all?
> Is the selective non-delivery reporting smart enough to reply with
> NDRs to legitimate messages where rDNS and everything else is in
> order, and simply to suppress when a forged header or other suspicious
> activity is detected? 
> 

No, they return an error code and don't accept the message.

> The use of an explicit subscription opt-in protects against more than
> one initial message being sent to an incorrect address, however my
> interest in bounce messages is what happens when an opted-in address
> stops working at some point in the future.

It should return an error message durring the SMTP transaction...
The mail server responded "550 User unknown" in reply to RCPT command.

The messages vary slightly, but are similar. AOL used to "bounce", but when 
they realised the problems it caused they fixed that.

> I'd like to be able to
> intelligently pick up that mail is not being delivered as it may be
> necessary to revert to paper and snailmail if important notices aren't
> being delivered and we're being informed of such.

Simply check your SMTP logs for error messages, they will be in a 
consistent format you can parse with a script. Apparently these message are 
being discarded instead of going to postmaster, or you aren't checking the 
postmaster box (usually whoever the server Admin is).
You will also have to check the mail box that messages would bounce to for 
other types of messages.


-- 
| Ric
|
From wb8tyw at qsl.network  Mon Jan 17 10:06:54 2005
From: wb8tyw at qsl.network (John E. Malmberg)
Date: Mon Jan 17 10:10:03 2005
Subject: [SC-Help] Re: Validating SMTP addresses
In-Reply-To: <csgbrt$iuv$1@news.spamcop.net>
References: <csgbrt$iuv$1@news.spamcop.net>
Message-ID: <csgkaf$nn8$1@news.spamcop.net>

Iain wrote:
> This message continues from my thread about [avoiding] getting blacklisted - 
> <cs35cr$f91$1@news.spamcop.net> - but I thought I'd start afresh as this is 
> a slightly different aspect of good list management.
> 
> I'm working through how to best validate an address when initially provided 
> by a web user and keep informed of the address' status. The checks I'm 
> considering are:


> 1. The likelihood of ISPs to provide NDRs for 'bad' addresses - or
> are  NDRs being suppressed due to them being farmed for spam purposes?

SMTP rejections never need be suppressed, as the sending server is told 
that the e-mail was refused through the protocol.  This causes an NDR to 
be created by the sending server.

In the case of mailing list software that is integrated with the mail 
server software, the non-delivery information is directly handled with 
out an actual NDR being generated.

NDR's sent from other than the user's server are bad as over 80% of them 
will be sent to forged addresses.  Any mail server still doing so is 
risking getting blocked by several public and private blocking lists, or 
having content filters learn to discard any output from it silently.


Blammo wrote a very good summary.  The only thing that I have to add is 
this:

At least two broadband ISPs that I have been on have for several 
weekends mis-configured their mail servers to reject all incoming e-mail 
with a no-such user code.

In the one set of cases that I got answers about, it seems that they 
wanted to switch to a different server, so they shutdown the old server, 
and put the new server on line in it's place while they loaded in the 
users by hand, (making several typos on the old passwords).  If e-mail 
came in for a user that was not yet on the new mail server, it was 
rejected with a no such user.

Unfortunately they did not learn from that obvious mistake and repeated 
it the next time they moved to a new mail server.

> 2. The likelihood that any NDR received will be machine readable such
> that a snailmail process could be kicked-off and the user's account
> marked as now having a 'bad' address...so that they can be asked to
> provide a fresh  working address at next web login

If your mailing list management software does not have an easy way to 
detect the rejections to it's mailings, and to also handle the majority 
of the formats for NDR messages for those mail servers that abusively 
bounce undeliverable messages, then it clearly is not even close to what 
is state of the art.

Mailing list software is supposed to detect such things and suspend 
future mailings to that e-mail address until action is taken.

Some software will attempt to send a final message that if it is not 
rejected explains that the mailing list was getting NDRs or rejections, 
and that the person must reconfirm their signup or this is the last 
e-mail they will receive.

And of course you will never know how may spam filters are just silently 
deleting things.

-John
wb8tyw@qsl.network
Personal Opinion Only
From ric.gates at bigsleep.org  Mon Jan 17 15:33:10 2005
From: ric.gates at bigsleep.org (Blammo)
Date: Mon Jan 17 10:35:04 2005
Subject: [SC-Help] Re: Validating SMTP addresses
References: <csgbrt$iuv$1@news.spamcop.net> <csgkaf$nn8$1@news.spamcop.net>
Message-ID: <Xns95E14CEC5D00Dblammo@216.154.195.61>

On 17 Jan 2005 John E. Malmberg entered spamcop.help and left 
news:csgkaf$nn8$1@news.spamcop.net:

> And of course you will never know how may spam filters are just silently 
> deleting things.
> 

Ah yes, good point.
You could add a note informing people what address to white-list.

"If you use junk mail filtering you can add our list address 
 'list-bounce@domain' to your white-list,
 for Spamassassin you can add this line to your user_prefs
 whitelist_from_rcvd	list-bounce@domain	server
"

-- 
| Ric
|
From wb8tyw at qsl.network  Mon Jan 17 11:20:27 2005
From: wb8tyw at qsl.network (John E. Malmberg)
Date: Mon Jan 17 11:25:03 2005
Subject: [SC-Help] Re: Validating SMTP addresses
In-Reply-To: <Xns95E14CEC5D00Dblammo@216.154.195.61>
References: <csgbrt$iuv$1@news.spamcop.net> <csgkaf$nn8$1@news.spamcop.net>
	<Xns95E14CEC5D00Dblammo@216.154.195.61>
Message-ID: <csgokc$qlb$1@news.spamcop.net>

Blammo wrote:
> On 17 Jan 2005 John E. Malmberg entered spamcop.help and left 
> news:csgkaf$nn8$1@news.spamcop.net:
> 
>>And of course you will never know how may spam filters are just silently 
>>deleting things.
>>
> Ah yes, good point.
> You could add a note informing people what address to white-list.
> 
> "If you use junk mail filtering you can add our list address 
>  'list-bounce@domain' to your white-list,
>  for Spamassassin you can add this line to your user_prefs
>  whitelist_from_rcvd	list-bounce@domain	server

Not real useful for many people.  They have no way to whitelist e-mail 
addresses.

This is the sad state of many networks that use content filtering 
instead of DNSbl based filtering as a primary anti-spam tool.  They give 
  their users a choice of either known imperfect content filtering or 
getting all the spam.

For the postmasters that I have that have effective spam control, in 
order to whitelist, I would have to specify the I.P range that the 
e-mail would be coming from.

I would also have to explain why that I.P. address would likely show up 
on one of their I.P. based blocking lists.

So far the only I.P. addresses that I am aware of that are mixing spam 
and legitimate e-mail are the ones operating web mailers that are 
allowing anonymous free accounts to send spam on a chronic basis.

-John
wb8tyw@qsl.network
Personal Opinion Only
From tim at kyologic.com  Mon Jan 17 12:24:46 2005
From: tim at kyologic.com (Tim Neudecker)
Date: Mon Jan 17 12:25:03 2005
Subject: [SC-Help] Held Mail and SpamCop news via RSS
Message-ID: <1gqj8yj.pt2sdpl6o4xeN%tim@kyologic.com>

I have googled spamcop and searched the nntp archives here, but I cant
seem to find any mention of RSS feeds from spamcop.

I would love to have an RSS feed of my held mail, so I could report it
sooner instead of having to think every couple hours to go look at my
held mail, my RSS program could just tell me  "Hey you have help mail
buddy!"

also the news and update info from the mail logon screen could show up
in the feed as well. 

any chance of a rss feed?

Tim

-- 
Tim Neudecker
tim@kyologic.com
From ric.gates at bigsleep.org  Mon Jan 17 17:31:01 2005
From: ric.gates at bigsleep.org (Blammo)
Date: Mon Jan 17 12:35:03 2005
Subject: [SC-Help] Re: Validating SMTP addresses
References: <csgbrt$iuv$1@news.spamcop.net> <csgkaf$nn8$1@news.spamcop.net>
	<Xns95E14CEC5D00Dblammo@216.154.195.61> <csgokc$qlb$1@news.spamcop.net>
Message-ID: <Xns95E160E7A4118blammo@216.154.195.61>

On 17 Jan 2005 John E. Malmberg entered spamcop.help and left 
news:csgokc$qlb$1@news.spamcop.net:

> For the postmasters that I have that have effective spam control, in 
> order to whitelist, I would have to specify the I.P range that the 
> e-mail would be coming from.
> 

I'm mainly talking about filtering in reply to your comment about filters 
deleting mail. Many ISPs offer a Spamassassin like option which often allow 
some type of white list.

-- 
| Ric
|
From nobody at spamcop.net  Mon Jan 17 14:33:18 2005
From: nobody at spamcop.net (Pop)
Date: Mon Jan 17 14:35:05 2005
Subject: [SC-Help] Re: Forced perspective spam
References: <10808-41EBAC47-160@storefull-3217.bay.webtv.net>
Message-ID: <csh3tn$2r4$1@news.spamcop.net>

It's a Miracle wrote:
> Here's a trick spammers use to fool people into thinking they 
> are
> getting child porn. It's a photography trick so it has to be 
> planned
> before the picture is taken.

What's the point of this?  There are many, many other ways to 
force perspective, and this isn't the easiest or quickest of them 
by any means.  It seems to be a pointless post.

Pop

From MikeE at ster.invalid  Mon Jan 17 13:31:44 2005
From: MikeE at ster.invalid (Mike Easter)
Date: Mon Jan 17 16:35:14 2005
Subject: [SC-Help] 
	=?iso-8859-1?q?Re=3A_=22Subject=3A__=7Cc=7CI=7C=E5L=CC=7CS=22=2E?=
References: <csha7j$71t$1@news.spamcop.net>
Message-ID: <cshap1$7as$1@news.spamcop.net>

Fred K wrote:
> Can anybody tell me about the content of the "Subject:

> Content-transfer-encoding: 8BIT

The sender was configured to send header information in 8 bits, which OE
can also do in its Send options - but your configuration isn't 'getting
it' or rather didn't get it.

You want to know what the 8 bits 'used to' say, when you are only
'getting' 7 of the bits.  That won't work when the chars are extended
beyond the 7 bits.


-- 
Mike Easter
kibitzer, not SC admin

From PossumTrot at dont.spam.me  Mon Jan 17 16:02:15 2005
From: PossumTrot at dont.spam.me (Possum Trot)
Date: Mon Jan 17 19:10:04 2005
Subject: [SC-Help] Deputy:  Autoresponder format question
Message-ID: <cshjrv$d0l$1@news.spamcop.net>

A couple of months ago the format of the Spamcop Autoresponder message 
changed such that it has become harder to keep track of which of the links I 
have selected to report.  Originally the links showed up as blue, then each 
changed to red after it had been selected.  Today they remain blue so I 
can't tell by sight which have and have not been selected for reporting.

It seems to have changed about the time they put XP and/or SP2 on this 
machine.  Is this the result of some obscure OE parm, or is this because of 
some coincidental change by Spamcop in generating these links?  If the 
latter, can we get it changed back?

Below is a current link.

Use links to finish spam reporting (members use cookie-login please!):
http://www.spamcop.net/sc?id=z713685655z4f409953edb9b2422e9861ef789a6ab0z

(probably shows red here because of copy/paste) 


From ric.gates at bigsleep.org  Tue Jan 18 00:30:05 2005
From: ric.gates at bigsleep.org (Blammo)
Date: Mon Jan 17 19:35:04 2005
Subject: [SC-Help] Re: Deputy:  Autoresponder format question
References: <cshjrv$d0l$1@news.spamcop.net>
Message-ID: <Xns95E1A7F43BCB1blammo@216.154.195.61>

On 17 Jan 2005 Possum Trot entered spamcop.help and left
news:cshjrv$d0l$1@news.spamcop.net: 

> It seems to have changed about the time they put XP and/or SP2 on this
> machine.  Is this the result of some obscure OE parm, or is this
> because of some coincidental change by Spamcop in generating these
> links?  If the latter, can we get it changed back?
> 

I'm sure you are talking about the eMail you receive from Spamcop.
These are in plain text, so how you see it has nothing to do with Spamcop. 
The fact that they show up as clickable links at all is simply a matter of 
convenience (I actually prefer a right-click or double-click, as XNews does 
for me here).

Does it not show an outline around the link? Items with focus (such as the 
link you just clicked on) should have an outline around them. You should 
also see the outline when you TAB (MS patent-pending) between links. As far 
as the color goes (visited link color) there may be an option somewhere for 
that, with some programs the links won't change color until the page is 
refreshed/ reloaded.
-- 
| Ric
|
From TJLWBECGSGWU at spammotel.com  Tue Jan 18 00:34:36 2005
From: TJLWBECGSGWU at spammotel.com (Mathew Hendry)
Date: Mon Jan 17 19:35:10 2005
Subject: [SC-Help] Re: Deputy:  Autoresponder format question
References: <cshjrv$d0l$1@news.spamcop.net>
Message-ID: <ldlou01tc2s0ckdd9a0qes3h640penfa2d@4ax.com>

"Possum Trot" <PossumTrot@dont.spam.me> wrote in
<cshjrv$d0l$1@news.spamcop.net>:

>A couple of months ago the format of the Spamcop Autoresponder message 
>changed such that it has become harder to keep track of which of the links I 
>have selected to report.  Originally the links showed up as blue, then each 
>changed to red after it had been selected.  Today they remain blue so I 
>can't tell by sight which have and have not been selected for reporting.
>
>It seems to have changed about the time they put XP and/or SP2 on this 
>machine.  Is this the result of some obscure OE parm, or is this because of 
>some coincidental change by Spamcop in generating these links?  If the 
>latter, can we get it changed back?
>
>Below is a current link.
>
>Use links to finish spam reporting (members use cookie-login please!):
>http://www.spamcop.net/sc?id=z713685655z4f409953edb9b2422e9861ef789a6ab0z
>
>(probably shows red here because of copy/paste) 

Shows as a pretty shade of green here. :)

The autoresponder messages are sent in plain text, not HTML, so any
colouring and other decoration is being done locally by OE. OE inherits much
from Internet Explorer, so your first port of call should be IE's colour
options (Tools/Internet Options.../General/Colors...)

-- Mat.

From nobody at devnull.spamcop.net  Mon Jan 17 19:18:04 2005
From: nobody at devnull.spamcop.net (WazoO)
Date: Mon Jan 17 20:20:03 2005
Subject: [SC-Help] Re: Deputy:  Autoresponder format question
References: <cshjrv$d0l$1@news.spamcop.net>
Message-ID: <csho4d$fju$1@news.spamcop.net>

"Possum Trot" <PossumTrot@dont.spam.me> wrote in message
news:cshjrv$d0l$1@news.spamcop.net...
> A couple of months ago the format of the Spamcop Autoresponder message
> changed such that it has become harder to keep track of which of the links
I
> have selected to report.  Originally the links showed up as blue, then
each
> changed to red after it had been selected.  Today they remain blue so I
> can't tell by sight which have and have not been selected for reporting.
>
> It seems to have changed about the time they put XP and/or SP2 on this
> machine.  Is this the result of some obscure OE parm, or is this because
of
> some coincidental change by Spamcop in generating these links?  If the
> latter, can we get it changed back?

  As stated by others, nothing in the e-mail sent deals with colors.
This is something that happens at your end.  You brought up OE,
so in that light is all the Microsoft/Windows sucks/security tie-in
issues.  For example, one possibility that the links don't "change
colors" might be that someone has set the "History" setting under
IE to be "0" (zero), therefore the OE rendering of the e-mail
contents by the IE/Windows resources doesn't recognize that
the link was ever visited, as there "is no History" entry.  Lots
of other possibilities, but hoping that you see how difficult it
might be to give you the one correct answer from this side
of the screen.

> Below is a current link.
>
> Use links to finish spam reporting (members use cookie-login please!):
> http://www.spamcop.net/sc?id=z713685655z4f409953edb9b2422e9861ef789a6ab0z
>
> (probably shows red here because of copy/paste)

And again, it would only be "red" if "I" had actually visited that
link/site and that 'fact' was 'recorded' in the "History" folder.


From Amused_2_Death_ at webtv.net  Mon Jan 17 20:11:08 2005
From: Amused_2_Death_ at webtv.net (It's a Miracle)
Date: Mon Jan 17 21:35:09 2005
Subject: [SC-Help] Re: Forced perspective spam
References: <csh3tn$2r4$1@news.spamcop.net>
Message-ID: <21384-41EC703C-267@storefull-3212.bay.webtv.net>

pop said:
>What's the point of this? There are
> many, many other ways to force
> perspective, and this isn't the easiest or
> quickest of them by any means. It
> seems to be a pointless post. 

>Pop

Why? because it's pathetic how even big gun spam fighters get trolled by
the trick.It's not their fault peoples brains are just deficient to
analyze a 3 dimensional scene in a 2d picture. I just want to enlighten
people so they don't get trolled by the ultimate troll.

They aren't getting child porn just evidence of exploitation. Thats a
big difference! The child porn problem is a myth.Once your aware of
forced perspective the picture don't have the same impact and the
ultimate troll don't work.Spammers aren't dumb they aren't spreading
evidence of felony's around so they get mandatory sentences.It's all
forced perspective tricks. It's better to educate yourself on their
tricks because these pictures are legal and aren't going away unless
some laws changes.

--
My kaleidoscope art webpage:
http://community-2.webtv.net/Amused_2_Death_/Kaleidoscope/

Keep spam illegitimate, Report spam to:
http://spamcop.net/ 

From nobody at spamcop.net  Mon Jan 17 22:39:10 2005
From: nobody at spamcop.net (Pop)
Date: Mon Jan 17 22:40:15 2005
Subject: [SC-Help] Re: Forced perspective spam
References: <csh3tn$2r4$1@news.spamcop.net>
	<21384-41EC703C-267@storefull-3212.bay.webtv.net>
Message-ID: <csi0cn$k8a$1@news.spamcop.net>



It's certainly not a Miracle wrote:
> pop said:
>> What's the point of this? There are
>> many, many other ways to force
>> perspective, and this isn't the easiest or
>> quickest of them by any means. It
>> seems to be a pointless post.
>
>> Pop
>
> Why? because it's pathetic how even big gun spam fighters get 
> trolled
== No, that's totally irrelevant and of no value spam wise OR 
child porn wise.  Spam wise, it's the PHOTO, NOT how the photo 
was made, that makes it reportable and abhorrant!  I also 
seriously doubt many "big gin" spam fighters would be "trolled" 
by that anyway, even if it was relevant to spam/pornography 
dispensing.

> by the trick.It's not their fault peoples brains are just 
> deficient to
> analyze a 3 dimensional scene in a 2d picture. I just want to
> enlighten people so they don't get trolled by the ultimate 
> troll.
==  You consider yourself the ultimate troll, don't you, you 
inmitigated piece of tripe filled with mammalian feces?  I don't 
give a turd HOW the photo was made when someone puts a 
pornographic image in front of my mother, sister, daughter, next 
door neighbor, etc..  If I could, I'd now see to it that YOUR 
family all received e very piece of it that I receive, and let 
you argue around your neighborhood or prison cell, defending it. 
If it's "real" child subjects, that's just gravy and helps to add 
to how long that perp will be in the slammer getting slammed by 
all the other slammees who hate child porn nearly as often and 
much as the general public.  Only diff is, they're more violent 
and a lot hornier.

>
> They aren't getting child porn just evidence of exploitation.
==  This is a spam group; not a child exploitation group.  Even 
so, let's say we had a photo of your mother and grandmother, put 
it thru the xray software to make them naked, and then morphed 
them until they were simultaneously using knves and spoons and 
forks to (fill in your own mental picture here).  I guess that'd 
be OK, because your mother and your grandmother didn't really do 
that, right?  So, it's OK if everyone in the world likes those 
pics, and trades them around for a few years?  Hell, most of the 
spammers sending out that crap have abs9olutely no idea where any 
of it came from, nor do they care.  It's m-o-n-e-y that matters 
to them, and nothing else unless you count not getting caught.

Thats a
> big difference!
==  Not on this group, it's not.  One is just as abhorrant as the 
other to me and to most thinking people because the innuendo is 
there.  It's not OK to call and apple an orange; if it looks like 
an orange but it's an apple, that's still  fraud and when you 
play it in the child porn rings, you play in dangerous circles.

The child porn problem is a myth.
==  You, my dear ignorant, are a myth; ical idiot of gigantic 
proportions, and I'm  not talking about that pimple between your 
legs.

Once your aware of
> forced perspective the picture don't have the same impact and 
> the
==  Wrong again, kiddie-porn breath; it's the CONTENT that gets 
perverts on, not any thought about how real or not the so called 
picture is.  Again, it matters not one iota whether the source is 
real or not; the spam crime is still there, it is illegal, and it 
is punishable.  It's gravy if the perp were actually the 
photographer.  Either way he's fried and the slamming he gets 
from other prisoners will be just as real either way.  He'd 
better have a good supply of vaseline if he gets caught.
   One of my cop friends in particular just loves it when he gets 
to testify against a kiddie porner because he knows what the poor 
sap's in for if he's convicted.  An d guess what?  Most are 
convicted, if it makes it to the courtroom.  Else they don't get 
that far.

> ultimate troll don't work.
==  Totally irrelevant, and completely off topic.

Spammers aren't dumb they aren't spreading
> evidence of felony's around so they get mandatory 
> sentences.It's all
> forced perspective tricks.
==  That one's actually comical.  Prisoners don't discriminate 
that way so he's going to have fun any way it comes out.  Those 
buzz words you managed to pick up somewhere haven't served you 
very well.  Probably about 0.001% of the porn sent out IS  really 
from the originator; nor do the senders or any willing perverted 
receivers even care!  Very few take the actual pictures, but 
millions distribute them and try to make money off them.  A horny 
toad of a bass turd doesn't care whether it was real or not; in 
his demented  mind, it's real at least until he finishes 
ejaculating over it.


 It's better to educate yourself on their
> tricks because these pictures are legal and aren't going away 
> unless
> some laws changes.
==  Education is key, all the way around, and that includes you, 
because you are seriously misinformed if you think you can make 
people believe it's OK to have child porn flying all around them 
and that the perpetrator (spammer, scammer, whatever) is NOT 
subject to prison terms, usually in a fed penitentiary since 
almost all of them cross state lines.  Child porn is bad, bad, 
bad, and the dissemination of same is bad, bad, ba; so, that way, 
you're right - it's a "d" less bad, which ain't not very much.

Now, go spew your off topic flatulence elsewhere and stop 
supporting bottom-feeding fish turds, I mean, bass turds!  You do 
know, of course, that you can go to jail for just having kiddie 
porn on your computer when your next door neighbor turns you in 
as a kiddie porn trader, don't you?  You won't get a chance to 
delete it: They take the computer and all peripherals with them a 
few seconds after your door opens, and it opens whether yo want 
it opened or not!

Disregards,


From Kilgallen at SpamCop.net  Tue Jan 18 05:06:49 2005
From: Kilgallen at SpamCop.net (Larry Kilgallen)
Date: Tue Jan 18 06:10:21 2005
Subject: [SC-Help] Re: Forced perspective spam
References: <csh3tn$2r4$1@news.spamcop.net>
	<21384-41EC703C-267@storefull-3212.bay.webtv.net>
Message-ID: <fzCmVQ3LYeSy@eisner.encompasserve.org>

In article <21384-41EC703C-267@storefull-3212.bay.webtv.net>, Amused_2_Death_@webtv.net (It's a Miracle) writes:

> Why? because it's pathetic how even big gun spam fighters get trolled by
> the trick.It's not their fault peoples brains are just deficient to
> analyze a 3 dimensional scene in a 2d picture. I just want to enlighten
> people so they don't get trolled by the ultimate troll.

I am sure the perspective trick is not enough to prevent this from
being used by some District Attorney to get re-elected, so reporting
the spammer still should produce the desired effect.
From bclee at spamcop.net  Tue Jan 18 12:41:21 2005
From: bclee at spamcop.net (Brian Lee)
Date: Tue Jan 18 15:45:04 2005
Subject: [SC-Help] Re: Are Spam submissions by e-mail working?
In-Reply-To: <Xns95C091AC24F93greenriverordinance@216.154.195.61>
References: <Xns95C091AC24F93greenriverordinance@216.154.195.61>
Message-ID: <csjs9i$n3k$1@news.spamcop.net>

Tom Betz wrote:
> Over the last couple of days I've submitted quite a few spams by e-mail, 
> but have not received any responses from Spamcop.

I just came here because I'm having the same problem.  Over the last 
week it appears that email reporting has stopped working for me, 
anything I report that way just vanishes.  At first I thought it might 
be a problem with a particular email client, but I've since tried it on 
three different OS/email client combinations that all worked before, and 
none work now.  I never hear back from spamcop and the submissions never 
appear when I log in to the web page.
From bhetrick at notinnedmeats.iname.com  Tue Jan 18 19:37:57 2005
From: bhetrick at notinnedmeats.iname.com (Brian Hetrick)
Date: Tue Jan 18 19:40:48 2005
Subject: [SC-Help] Re: Are Spam submissions by e-mail working?
References: <Xns95C091AC24F93greenriverordinance@216.154.195.61>
	<csjs9i$n3k$1@news.spamcop.net>
Message-ID: <cska5n$vfd$1@news.spamcop.net>

"Brian Lee" <bclee@spamcop.net> wrote ...
> I just came here because I'm having the same problem.  Over the last 
> week it appears that email reporting has stopped working for me, 
> anything I report that way just vanishes.  At first I thought it
> might be a problem with a particular email client, but I've since
> tried it on three different OS/email client combinations that all
> worked before, and none work now.

Something very like this happened to me: my mail provider started
whacking anything with an e-mail attachment, as some viruses spread
that way. (?) Making the spam attachments text file got them past the
filter, and SpamCop still understood.


From bclee at spamcop.net  Tue Jan 18 20:15:30 2005
From: bclee at spamcop.net (Brian Lee)
Date: Tue Jan 18 23:20:03 2005
Subject: [SC-Help] Re: Are Spam submissions by e-mail working?
In-Reply-To: <cska5n$vfd$1@news.spamcop.net>
References: <Xns95C091AC24F93greenriverordinance@216.154.195.61>
	<csjs9i$n3k$1@news.spamcop.net> <cska5n$vfd$1@news.spamcop.net>
Message-ID: <cskmt2$7ch$1@news.spamcop.net>

Thanks for the suggestion, unfortunately that's not it.

Brian Hetrick wrote:
> 
> my mail provider started whacking anything with an e-mail attachment

From nobody at devnull.spamcop.net  Tue Jan 18 22:39:05 2005
From: nobody at devnull.spamcop.net (WazoO)
Date: Tue Jan 18 23:40:03 2005
Subject: [SC-Help] Re: Are Spam submissions by e-mail working?
References: <Xns95C091AC24F93greenriverordinance@216.154.195.61>
	<csjs9i$n3k$1@news.spamcop.net>
Message-ID: <csko98$8b8$1@news.spamcop.net>

"Brian Lee" <bclee@spamcop.net> wrote in message
news:csjs9i$n3k$1@news.spamcop.net...
> Tom Betz wrote:
> > Over the last couple of days I've submitted quite a few spams by e-mail,
> > but have not received any responses from Spamcop.
>
> I just came here because I'm having the same problem.  Over the last
> week it appears that email reporting has stopped working for me,
> anything I report that way just vanishes.  At first I thought it might
> be a problem with a particular email client, but I've since tried it on
> three different OS/email client combinations that all worked before, and
> none work now.  I never hear back from spamcop and the submissions never
> appear when I log in to the web page.

The Forum FAQ has a number of entries on these e-mail issues.
The www.spamcop.net FAQ (included within the Forum FAQ)
has at least one entry.  Usually, the symptom you describe is
based on your Registered e-mail address bouncing, at which
time the SpamCop system quit trying to send e-mail to you.
The catch is that usually, when you log into "your" spamcop.net
page, you'd see some sort of note about a problem with your
e-mail, and an option to "clear" the problem.  You state that
you've logged in and didn't see this.

Based on the FAQ data, it still wouldn't hurt to go on and
"tickle" your account settings to see if that opens up that
channel again.

The next issue has been some ISP actions of adding in
filtering on outgoing e-mail, basically dropping your
spam submittal on its way out because it "looks like spam"
I've got a listing of known ISPs in a FAQ entry "over there"

Beyond that, there's always the direct contact mode
available to you (also in the FAQ)
http://forum.spamcop.net/forums/


From bclee at spamcop.net  Tue Jan 18 23:42:29 2005
From: bclee at spamcop.net (Brian Lee)
Date: Wed Jan 19 02:45:04 2005
Subject: [SC-Help] Re: Are Spam submissions by e-mail working?
In-Reply-To: <csko98$8b8$1@news.spamcop.net>
References: <Xns95C091AC24F93greenriverordinance@216.154.195.61>
	<csjs9i$n3k$1@news.spamcop.net> <csko98$8b8$1@news.spamcop.net>
Message-ID: <csl316$ecr$1@news.spamcop.net>

WazoO wrote:
> 
> The catch is that usually, when you log into "your" spamcop.net
> page, you'd see some sort of note about a problem with your
> e-mail, and an option to "clear" the problem.  You state that
> you've logged in and didn't see this.

Yes, when I don't get the reply email within about 10 min I usually log 
into the site to see if it shows up there.  No luck.

> The next issue has been some ISP actions of adding in
> filtering on outgoing e-mail, basically dropping your
> spam submittal on its way out because it "looks like spam"
> I've got a listing of known ISPs in a FAQ entry "over there"

I'm starting to wonder about this one.  I'm finding it's hit and miss, 
every once in a while one gets through -- half an hour ago a spam I 
reported made it, but the one I reported 10 minutes ago was ignored as 
usual.
From ipmarketing at spamcop.net  Wed Jan 19 14:14:04 2005
From: ipmarketing at spamcop.net (Iain)
Date: Wed Jan 19 09:15:23 2005
Subject: [SC-Help] Re: Validating SMTP addresses
References: <csgbrt$iuv$1@news.spamcop.net>
	<Xns95E144A99A58Eblammo@216.154.195.61>
Message-ID: <cslpvh$q69$1@news.spamcop.net>

"Blammo" <ric.gates@bigsleep.org> wrote in message 
news:Xns95E144A99A58Eblammo@216.154.195.61...
> On 17 Jan 2005 Iain entered spamcop.help and left
> news:csgbrt$iuv$1@news.spamcop.net:
>

Many thanks for both your and Larry's comments. To explain a  bit more...

This relates to people opting to do their tax online. As such it's a 
Government service. The reason for the address checking is that it's a 
requirement of use of the service that the user provides a valid Email 
address, hence there's a need to check it as best and possible and note if 
the address ever 'goes bad' for some reason. This is because the users are 
asking not to receive snailmail tax reminders and instead to receive 
notification via Email. It is therefore necessary to ensure 'best efforts' 
are made to ensure people receive the notifications and that if for some 
reason their Email stops working, some process can kick-in that maybe 
reverets to snailmail.

My point is this isn't as simple as someone going on a mailing list and if 
they drop off there being no consequence other than them not receiving 
whatever it was they were receiving.

My interest in NDRs was that my *presumption* was that many ISPs might 
supress a real-time user check at the MAIL TO:. You suggest the check is 
always made during the SMTP conversation and a 5xx will come back. However, 
I've seen articles about disabling mail address enumeration to stop it being 
used as a method of address harvesting. For instance article: "A security 
update is available to help prevent the enumeration of Exchange Server 2003 
e-mail addresses" - http://support.microsoft.com/kb/842851. This happens to 
be around Exchange but the same principle could be used with any SMTP agent.

If an SMTP server is setup in the way this article suggests then the MAIL TO 
will always give back a 250 and (I presume) churn out a NDR once it attempts 
delivery - after the SMTP delivery has been completed. Larry makes the point 
about the problems with this and I know from bitter experience the effect of 
NDRs being sent based on forged Reply-To and header fields. I peridically 
suffer 'NDR floods' based on someone elses spam...it's amazing how many 
names I apparently go under!

So is your view that the behaviour suggested in the MS article quoted above 
is unusual and instead relying on a 5xx reply during the mail send is a (the 
only?) reliable way to detect a 'bad address'? It would seem simpler to 
handle than parsing NDR messages.

Oh and also, this isn't as simple as using commercial mail list software. 
This isn't just pumping out info to opted-in people, but linking SMTP alerts 
with an online system and tax status that can recognise if messages aren't 
getting to people and use this to trigger a request for an Email address 
reinput at next login and/or result in 'paper being switched back on' to 
ensure legal requirements for best efforts to deliver notices are met. So I 
need as best I can ensure that any reasonable advice that a notice isn't 
being delivered is noted and acted upon.

Thanks again for your help and thoughts.../Iain 


From bhetrick at notinnedmeats.iname.com  Wed Jan 19 11:58:57 2005
From: bhetrick at notinnedmeats.iname.com (Brian Hetrick)
Date: Wed Jan 19 12:00:05 2005
Subject: [SC-Help] Re: Are Spam submissions by e-mail working?
References: <Xns95C091AC24F93greenriverordinance@216.154.195.61>
	<csjs9i$n3k$1@news.spamcop.net> <cska5n$vfd$1@news.spamcop.net>
	<cskmt2$7ch$1@news.spamcop.net>
Message-ID: <csm3ku$f0$1@news.spamcop.net>

Could it be that your mail host is not receiving properly?  My email 
submissions to SpamCop go out through my ISP's SMTP server, but the 
replies come back via a mail service SMTP server; the timestamps on 
SpamCop replies to my own submissions in the face of flakiness at the 
mail service lead me to the conclusion that SpamCop does not queue the 
responses to email submissions. Apparently, the SMTP session is 
started, the response is generated "on the fly" and the spams are 
simultaneously put into the database, and the SMTP session is ended. 
One result of this approach is that the spams are not available 
through the web interface until the reply email has been successfully 
sent. 


From Paul.Sawyer.does.not.want.spam at unh.BAD.EXAMPLE.edu  Wed Jan 19 18:32:18 2005
From: Paul.Sawyer.does.not.want.spam at unh.BAD.EXAMPLE.edu (Paul Sawyer)
Date: Wed Jan 19 13:35:10 2005
Subject: [SC-Help] Re: Validating SMTP addresses
References: <csgbrt$iuv$1@news.spamcop.net>
	<Xns95E144A99A58Eblammo@216.154.195.61> <cslpvh$q69$1@news.spamcop.net>
Message-ID: <Xns95E389B79F5F2Senex@216.154.195.61>

"Iain" <ipmarketing@spamcop.net> wrote in
news:cslpvh$q69$1@news.spamcop.net: 

> Many thanks for both your and Larry's comments. To explain a  bit
> more... 
> 
> This relates to people opting to do their tax online. As such it's a 
> Government service. The reason for the address checking is that it's a
> requirement of use of the service that the user provides a valid Email
> address, hence there's a need to check it as best and possible and
> note if the address ever 'goes bad' for some reason. This is because
> the users are asking not to receive snailmail tax reminders and
> instead to receive notification via Email. It is therefore necessary
> to ensure 'best efforts' are made to ensure people receive the
> notifications and that if for some reason their Email stops working,
> some process can kick-in that maybe reverets to snailmail.
> [...]

With USPS First Class Mail, assuming success if no bounce has a high 
probability of truth. It might even be considered as reasonable to 
assume receipt. Probably FCM is considered by your state laws to be 
acceptable for tax notification.  E-mail never was as reliable, and 
becomes less so.

I would put a notice on the top of the e-mail tax bill to the effect 
that:

  "Here is your tax bill.  Please reply to this message to confirm that 
you received it.  If we do not get your confirmation by [date], we will 
assume you did not receive this e-mail and your tax bill will also be 
sent to your address of record by U.S. Mail."  This would be similar to 
confirming the original opt-in notice.

Back this up with the necessary programs and policies to do this.  
Getting the policies through TPTB will be the hard part.  They will also 
want to define the exact wording and disclaimers such as, "this will not 
buy you more time to pay... etc...."  They will, of course, come up with 
a process that does not violate any state or federal laws....

-- 
From bclee at spamcop.net  Wed Jan 19 11:30:19 2005
From: bclee at spamcop.net (Brian Lee)
Date: Wed Jan 19 14:35:04 2005
Subject: [SC-Help] Re: Are Spam submissions by e-mail working?
In-Reply-To: <csl316$ecr$1@news.spamcop.net>
References: <Xns95C091AC24F93greenriverordinance@216.154.195.61>
	<csjs9i$n3k$1@news.spamcop.net> <csko98$8b8$1@news.spamcop.net>
	<csl316$ecr$1@news.spamcop.net>
Message-ID: <csmcgb$63m$1@news.spamcop.net>

I contacted the admins for the smtp server I was using for reporting, 
and they swear they do no filtering of outgoing email.  In fact I think 
they were insulted that I would even think such a thing.  Hmmm.

Brian Lee wrote:
> WazoO wrote:
> 
>> The next issue has been some ISP actions of adding in
>> filtering on outgoing e-mail, basically dropping your
>> spam submittal on its way out because it "looks like spam"
>> I've got a listing of known ISPs in a FAQ entry "over there"
From nobody at devnull.spamcop.net  Wed Jan 19 14:47:17 2005
From: nobody at devnull.spamcop.net (WazoO)
Date: Wed Jan 19 15:50:03 2005
Subject: [SC-Help] Re: Are Spam submissions by e-mail working?
References: <Xns95C091AC24F93greenriverordinance@216.154.195.61>
	<csjs9i$n3k$1@news.spamcop.net> <cska5n$vfd$1@news.spamcop.net>
	<cskmt2$7ch$1@news.spamcop.net> <csm3ku$f0$1@news.spamcop.net>
Message-ID: <csmh0u$963$1@news.spamcop.net>

"Brian Hetrick" <bhetrick@notinnedmeats.iname.com> wrote in message
news:csm3ku$f0$1@news.spamcop.net...
> Could it be that your mail host is not receiving properly?

I'm not anyone important <g>

>  My email submissions to SpamCop go out through my
> ISP's SMTP server, but the replies come back via a mail
> service SMTP server;

I don't do e-mail submittals or have an e-mail account, so
I've no idea what server you might be talking about with
the "mail service SMTP server" ....  we are back to the
way the SpamCop system exists these days, JT's e-mail,
newsgroup, and Forum hosting out in Georgia, the core
of the parsing/reporting side in California, Julian up in
Washington State, mirrors of some things around the
world, Akamai services used for connections around
the world ... that there would be a server or two
dedicated to outgoing mail would be to hard to
imagine .. just not sure if this is what you meant???

> the timestamps on SpamCop replies to my own
> submissions in the face of flakiness at the mail service

Kind of lost again on that one.  "mail service" again ..

> lead me to the conclusion that SpamCop does not queue the
> responses to email submissions. Apparently, the SMTP session is
> started, the response is generated "on the fly" and the spams are
> simultaneously put into the database, and the SMTP session is ended.

 Though not knowing, I'd more likely go with that your spam
submittal goes to an Inbox and once it's been recognized, the
"have recieved a spam" e-mail is kicked out.  The actual
processing of the spam occurs sometime later.  This was the
original intent of the e-mail submittal process .. the user could
process all his/her spam at once, say when coming into the
office .. get back to doing some productive work .. then as
time permitted, go and handle the actual review of the parse
results and send the complaints on their way.

> One result of this approach is that the spams are not available
> through the web interface until the reply email has been successfully
> sent.

 I know that this isn't true.  Many folks have stated that even
if this second e-mail never shows up (and have even stated
that you don't have to wait for that e-mail to arrive) you can
hit the site directly and use the Report-Now function.

As stated above, the e-mail submittal mode was put into place
to help some users with a 'new' process mode, help others that
were upset at having to wait while processing each sequential
spam via the paste-it-in-the-box mode, and as a bit of load /
performance control issue thing, allowing massive spam load
submittals to be holed up and processed as the system could
work them in ...

That Julian has somehow managed to keep throwing more
and more hardware into the mix has somehow convinced
many users that the e-mail submittal mode is supposed to
be and cause an immediate response.  I'm just trying to
point out that this isn't so.

That said, if you have some issues that might be explained
with time-stamp data, that would have to be provided so
someone could take a look at it.


From ric.gates at bigsleep.org  Wed Jan 19 22:20:03 2005
From: ric.gates at bigsleep.org (Blammo)
Date: Wed Jan 19 17:25:04 2005
Subject: [SC-Help] Re: Validating SMTP addresses
References: <csgbrt$iuv$1@news.spamcop.net>
	<Xns95E144A99A58Eblammo@216.154.195.61> <cslpvh$q69$1@news.spamcop.net>
Message-ID: <Xns95E391E88DC8Ablammo@216.154.195.61>

On 19 Jan 2005 Iain entered spamcop.help and left
news:cslpvh$q69$1@news.spamcop.net: 

> 
> My interest in NDRs was that my *presumption* was that many ISPs might
> supress a real-time user check at the MAIL TO:. You suggest the check
> is always made during the SMTP conversation and a 5xx will come back.
> However, I've seen articles about disabling mail address enumeration
> to stop it being used as a method of address harvesting.

Well, that's just stupid, if they are not talking about VRFY. You can check 
for an address two (or more) ways, 1; specifically ask if the address is 
valid, which is often disabled so the command isn't accepted, or 2; the 
more common way to just send a message and stop before sending any data. In 
fact I think I see C/R servers do this (in log files).
Now if you return OK that means all addresses look good and any address 
that is checked will get added to a junk mailing list, so as soon as 
someone opens a new account they start getting spam. I don't see the harm 
in just rejecting, it takes little bandwidth, does the right thing, and 
doesn't have to accept the message (where normally an OK would follow with 
the message DATA).

Now I don't know anything about Exchange except that there is some bug in 
it where it can be hacked and used as a mail relay.

> For instance
> article: "A security update is available to help prevent the
> enumeration of Exchange Server 2003 e-mail addresses" -
> http://support.microsoft.com/kb/842851. This happens to be around
> Exchange but the same principle could be used with any SMTP agent. 
> 

Well MS has their own terminology. They (aparently) are just delaying the 
response, they still return nouser eventually. Other mail servers have 
several other ways of dealing with this, for example you can limit the 
number of recipients. This shouldn't effect you anyway.

> If an SMTP server is setup in the way this article suggests then the
> MAIL TO will always give back a 250 and (I presume) churn out a NDR
> once it attempts delivery - after the SMTP delivery has been
> completed. Larry makes the point about the problems with this and I
> know from bitter experience the effect of NDRs being sent based on
> forged Reply-To and header fields.

Well, I don't see where the article says that, but no matter, you still 
have to deal with that, as you know it does happen.

> 
> So is your view that the behaviour suggested in the MS article quoted
> above is unusual and instead relying on a 5xx reply during the mail
> send is a (the only?) reliable way to detect a 'bad address'? It would
> seem simpler to handle than parsing NDR messages.
> 

Well I agree with what everyone else has said, getting a manual response 
from a message is the only way to verify that an address is GOOD. I don't 
think there is a reliable way to detect that an address is BAD.
I my opinion, if you know a message is unwanted (spam), there are no rules. 
The hard part for an Admin is to reliably determine that.

> Oh and also, this isn't as simple as using commercial mail list
> software. This isn't just pumping out info to opted-in people, but
> linking SMTP alerts with an online system and tax status that can
> recognise if messages aren't getting to people and use this to trigger
> a request for an Email address reinput at next login and/or result in
> 'paper being switched back on' to ensure legal requirements for best
> efforts to deliver notices are met. So I need as best I can ensure
> that any reasonable advice that a notice isn't being delivered is
> noted and acted upon. 
> 

I don't run a mailing list, but I am on several lists, some are good - they 
double-confirm and offer you to opt-out every month, some are bad and do 
none of that.
If I did start a mailing list, I think I know the steps I would take, and I 
think all of them have been mentioned here. I do, however, have an order 
form that sends a courtesy reply that sometimes returns an error to me 
(postmaster) when there is something wrong with the submitter's address. I 
know it needs some work, but actually the whole form needs some work, for 
one it doesn't do a real good job at checking the address. But I think we 
covered that topic pretty well.


-- 
| Ric
|
From bhetrick at notinnedmeats.iname.com  Wed Jan 19 19:08:16 2005
From: bhetrick at notinnedmeats.iname.com (Brian Hetrick)
Date: Wed Jan 19 19:10:03 2005
Subject: [SC-Help] Re: Are Spam submissions by e-mail working?
References: <Xns95C091AC24F93greenriverordinance@216.154.195.61>
	<csjs9i$n3k$1@news.spamcop.net> <cska5n$vfd$1@news.spamcop.net>
	<cskmt2$7ch$1@news.spamcop.net> <csm3ku$f0$1@news.spamcop.net>
	<csmh0u$963$1@news.spamcop.net>
Message-ID: <csmspg$h6c$1@news.spamcop.net>

"WazoO" <nobody@devnull.spamcop.net> wrote ...
> "Brian Hetrick" <bhetrick@notinnedmeats.iname.com> wrote in message
> news:csm3ku$f0$1@news.spamcop.net...
>>  My email submissions to SpamCop go out through my
>> ISP's SMTP server, but the replies come back via a mail
>> service SMTP server;
>
> I don't do e-mail submittals or have an e-mail account, so
> I've no idea what server you might be talking about with
> the "mail service SMTP server" ....  we are back to the
> way the SpamCop system exists these days, JT's e-mail,
> newsgroup, and Forum hosting out in Georgia, the core
> of the parsing/reporting side in California, Julian up in
> Washington State, mirrors of some things around the
> world, Akamai services used for connections around
> the world ... that there would be a server or two
> dedicated to outgoing mail would be to hard to
> imagine .. just not sure if this is what you meant???

I batch a bunch of spams into a series of attachments to a single mail
message. I send it through my ISP account. The mail goes from my home
PC to my ISP's SMTP engine to SpamCop/Ironport. Headers (as quoted by
SpamCop) on a reporting mail are, for example:

Received: from vmx2.spamcop.net (sc-smtp2.eq.ironport.com
[192.168.18.82])
by sc-app4.eq.ironport.com (Postfix) with ESMTP id 8BA915112
for <submit.[redacted]@spam.spamcop.net>; Wed, 19 Jan 2005
05:14:19 -0800 (PST)
Received: from sccrmhc12.comcast.net (204.127.202.56)
  by vmx2.spamcop.net with ESMTP; 19 Jan 2005 05:14:19 -0800
Received: from obehol
(h000d88411df4.ne.client2.attbi.com[24.62.160.45])
          by comcast.net (sccrmhc12) with SMTP
          id <20050119131417012000v3bpe>; Wed, 19 Jan 2005 13:14:17
+0000

Now, I have told SpamCop my address is brian at brianhetrick.com. The
brianhetrick.com domain is hosted by 9esolution, and the MX points to
a machine known as "1n-189.servernode.net" which handles both SMTP and
POP3, and at which my address is "local." Headers (as appearing on a
"SpamCop has accepted" notice) are:

Received: from [64.74.133.250] (helo=vmx2.spamcop.net)
 by 1n-189.servernode.net with esmtp (Exim 4.43)
 id 1CrFh7-0003t8-LL
 for [brian at] brianhetrick.com; Wed, 19 Jan 2005 08:16:22 -0500
Received: from sc-app4.eq.ironport.com (HELO spamcop.net)
(192.168.19.204)
  by vmx2.spamcop.net with SMTP; 19 Jan 2005 05:16:15 -0800

So, my email to SpamCop and SpamCop's emails to me travel through
different routes. In particular if the 9esolution.com machine goes
down then I can send SpamCop mail but SpamCop cannot send me mail.

> Though not knowing, I'd more likely go with that your spam
> submittal goes to an Inbox and once it's been recognized, the
> "have recieved a spam" e-mail is kicked out.

That's what I would think, too, but the evidence argues against it.

> This was the original intent of the e-mail submittal process .. the
> user could process all his/her spam at once, say when coming into
> the office .. get back to doing some productive work .. then as time
> permitted, go and handle the actual review of the parse results and
> send the complaints on their way.

This is exactly how I use it.

>> One result of this approach is that the spams are not available
>> through the web interface until the reply email has been
>> successfully
>> sent.
>
> I know that this isn't true.  Many folks have stated that even
> if this second e-mail never shows up (and have even stated
> that you don't have to wait for that e-mail to arrive) you can
> hit the site directly and use the Report-Now function.

This is contrary to my recent experience, and is the reason I have
hypothesized the SpamCop internal structure I have. At least for the
last several days, when the machine handling SMTP/POP3 (and also
HHTP, sadly) for my domain has been bouncing up and down, the spam I
have reported through email doesn't appear through the web interface
until second before the acknowledgement mail appears in my mailbox
-- even if this is half a day after I sent in the email with spam
attachments.

> That said, if you have some issues that might be explained
> with time-stamp data, that would have to be provided so
> someone could take a look at it.

I don't have an issue. I was posing a possible factor involved in the
original poster's issue.


From bhetrick at notinnedmeats.iname.com  Wed Jan 19 19:57:57 2005
From: bhetrick at notinnedmeats.iname.com (Brian Hetrick)
Date: Wed Jan 19 20:00:03 2005
Subject: [SC-Help] Re: Are Spam submissions by e-mail working?
References: <Xns95C091AC24F93greenriverordinance@216.154.195.61>
	<csjs9i$n3k$1@news.spamcop.net> <cska5n$vfd$1@news.spamcop.net>
	<cskmt2$7ch$1@news.spamcop.net> <csm3ku$f0$1@news.spamcop.net>
	<csmh0u$963$1@news.spamcop.net> <csmspg$h6c$1@news.spamcop.net>
Message-ID: <csmvmo$il9$1@news.spamcop.net>

Sigh. I recant.

I just noticed my domain's mail server is down (again), so I submitted 
some spams to SpamCop, and there they are in the web interface.

"Oh. Never mind." 


From dfm2a3l0t2 at spymac.com  Wed Jan 19 20:37:35 2005
From: dfm2a3l0t2 at spymac.com (D.F. Manno)
Date: Wed Jan 19 20:40:04 2005
Subject: [SC-Help] Re: Forced perspective spam
References: <csh3tn$2r4$1@news.spamcop.net>
	<21384-41EC703C-267@storefull-3212.bay.webtv.net>
	<responseguard-6AD6B8.18590517012005@news.cesmail.net>
Message-ID: <dfm2a3l0t2-AB711F.20373519012005@news.cesmail.net>

In article <responseguard-6AD6B8.18590517012005@news.cesmail.net>,
 "Bob W." <responseguard@hotmail.com> wrote:

> The problem is that your supposed "enlightenment" is, while possibly 
> well-intentioned, is ill-conceived and badly ill-informed.
> 
> Real child porn *is* being spamvertized.
> 
> Those who get it are free to -- and should -- report it as such.

That's all well and good, but I've noticed that all of the places you 
would report child porn to want you to give your identifying 
information. And since mere possession of child porn is a felony (at 
least in the U.S.), wouldn't I be incriminating myself by giving that 
info?
-- 
D.F. Manno
dfm2a3l0t2@spymac.com
"The work goes on, the cause endures, the hope still lives and the dream
will never die."
From nobody at devnull.spamcop.net  Wed Jan 19 20:03:41 2005
From: nobody at devnull.spamcop.net (WazoO)
Date: Wed Jan 19 21:05:04 2005
Subject: [SC-Help] Re: Are Spam submissions by e-mail working?
References: <Xns95C091AC24F93greenriverordinance@216.154.195.61>
	<csjs9i$n3k$1@news.spamcop.net> <cska5n$vfd$1@news.spamcop.net>
	<cskmt2$7ch$1@news.spamcop.net> <csm3ku$f0$1@news.spamcop.net>
	<csmh0u$963$1@news.spamcop.net> <csmspg$h6c$1@news.spamcop.net>
	<csmvmo$il9$1@news.spamcop.net>
Message-ID: <csn3ht$l19$1@news.spamcop.net>

"Brian Hetrick" <bhetrick@notinnedmeats.iname.com> wrote in message
news:csmvmo$il9$1@news.spamcop.net...
> Sigh. I recant.
>
> I just noticed my domain's mail server is down (again), so I submitted
> some spams to SpamCop, and there they are in the web interface.
>
> "Oh. Never mind."

Thanks a lot actually ... I was just getting around to composing
a few e-mail to other e-mail account holders to either set me
straight or give me some more data ... appreciate the
follow-up.


From ipmarketing at spamcop.net  Thu Jan 20 09:02:32 2005
From: ipmarketing at spamcop.net (Iain)
Date: Thu Jan 20 04:05:04 2005
Subject: [SC-Help] Re: Validating SMTP addresses
References: <csgbrt$iuv$1@news.spamcop.net>
	<Xns95E144A99A58Eblammo@216.154.195.61> <cslpvh$q69$1@news.spamcop.net>
	<Xns95E391E88DC8Ablammo@216.154.195.61>
Message-ID: <csns3h$48i$1@news.spamcop.net>


"Blammo" <ric.gates@bigsleep.org> wrote in message 
news:Xns95E391E88DC8Ablammo@216.154.195.61...
> On 19 Jan 2005 Iain entered spamcop.help and left
> news:cslpvh$q69$1@news.spamcop.net:
>
> Now if you return OK that means all addresses look good and ***any address
> that is checked will get added to a junk mailing list***, so as soon as
> someone opens a new account they start getting spam. I don't see the harm
> in just rejecting, it takes little bandwidth, does the right thing, and
> doesn't have to accept the message (where normally an OK would follow with
> the message DATA).

I'm not quite clear about what you mean? Does "any address that is checked 
will get added to a junk mailing list" refer to someone harvesting for the 
purposes of buillding a junk list? i.e. that the process of verifying the 
address at the MAIL TO enables someone to enumerate and so build a list? I'm 
just not quite with you...

>> For instance
>> article: "A security update is available to help prevent the
>> enumeration of Exchange Server 2003 e-mail addresses" -
>> http://support.microsoft.com/kb/842851. This happens to be around
>> Exchange but the same principle could be used with any SMTP agent.
>>
>
> Well MS has their own terminology. They (aparently) are just delaying the
> response, they still return nouser eventually. Other mail servers have
> several other ways of dealing with this, for example you can limit the
> number of recipients. This shouldn't effect you anyway.
>
My apology here...I pointed you to the wrong article. As you say, this one 
refers to a 'tar pit' setting to increasingly delay the SMTP response to a 
sender and so bog down someone address harvesting, but ultimately returns an 
in-session 5xx response. I should have referred to 
http://support.microsoft.com/?kbid=304897. Again this is an MS article 
(about preventing relaying) but I'm presuming the logic is shows need not be 
exclusive to MS product. What this article mentions is:

"some Microsoft SMTP products do not perform a directory lookup before they 
accept SMTP e-mail messages for delivery"

and

"The only requirement [of RFC 282, sections 2.1 and 3.7] to prevent relay is 
a verification that the domain part of the TO address is local. A check of 
the mail server's directory to see if the recipient is valid is an option, 
but it is not required. If a mail server accepts a message and then later 
decides that it cannot deliver the message, the server must generate an NDR. 
The Microsoft SMTP products comply with this requirement."

It then goes on to explain the settings are this way for performance and 
because the directory need not be online during the SMTP conversation. The 
important point though is: "If a mail server accepts a message and then 
later decides that it cannot deliver the message, the server must generate 
an NDR". So then the only rejection is an NDR. The send will actually be 
accepted 250 ok

> Well I agree with what everyone else has said, getting a manual response
> from a message is the only way to verify that an address is GOOD.

Yss that's accepted, I'm trying to think about a manual reponse being 
obtained and then an address going bad in n months time. I do have some 
ideas that are linked with anti-phishing but am simply trying to cover as 
many angles as possible.

I guess really, realising that every ISP can be set-up differently, I'm 
hoping for some guidance on likely normal behaviour (the 80-90% behaviour). 
Sounds like your belief is that would be a 5xx response at send time which 
is good and seems a more reliable method of detecting an address is no 
longer valid. That means that parsing any NDR replies to extract info is 
less critical which is good as my presumption is:

1. The precise format of NDRs varies making them harder to grep. Even 
response codes could be in the form 511 or 5.1.1 so not even consistency 
there :-(

2. Some ISPs may not send NDRs although I guess in that case they should be 
giving an immediate 5xx during the mail send?


Thanks again for your help and insight :-)

.../Iain 


From nobody at spamcop.net  Thu Jan 20 09:33:15 2005
From: nobody at spamcop.net (Pop)
Date: Thu Jan 20 09:35:02 2005
Subject: [SC-Help] Re: Forced perspective spam
References: <csh3tn$2r4$1@news.spamcop.net>
	<21384-41EC703C-267@storefull-3212.bay.webtv.net>
	<responseguard-6AD6B8.18590517012005@news.cesmail.net>
	<dfm2a3l0t2-AB711F.20373519012005@news.cesmail.net>
Message-ID: <csoffc$ev2$1@news.spamcop.net>

D.F. Manno wrote:
> In article 
> <responseguard-6AD6B8.18590517012005@news.cesmail.net>,
> "Bob W." <responseguard@hotmail.com> wrote:
>
>> The problem is that your supposed "enlightenment" is, while 
>> possibly
>> well-intentioned, is ill-conceived and badly ill-informed.
>>
>> Real child porn *is* being spamvertized.
>>
>> Those who get it are free to -- and should -- report it as 
>> such.
>
> That's all well and good, but I've noticed that all of the 
> places you
> would report child porn to want you to give your identifying
> information. And since mere possession of child porn is a 
> felony (at
> least in the U.S.), wouldn't I be incriminating myself by 
> giving that
> info?

If you were hoarding/hosting it, yes.  Are you?  Your interest, 
in view of all the misinformation and rhetoric seems odd.

Pop

From h9vzc2i02 at sneakemail.com  Thu Jan 20 09:01:32 2005
From: h9vzc2i02 at sneakemail.com (Anon_)
Date: Thu Jan 20 12:05:06 2005
Subject: [SC-Help] Re: Forced perspective spam
References: <csh3tn$2r4$1@news.spamcop.net>
	<21384-41EC703C-267@storefull-3212.bay.webtv.net>
	<responseguard-6AD6B8.18590517012005@news.cesmail.net>
	<dfm2a3l0t2-AB711F.20373519012005@news.cesmail.net>
	<csoffc$ev2$1@news.spamcop.net>
Message-ID: <csoo5e$le3$1@news.spamcop.net>


"Pop" <nobody@spamcop.net> wrote in message
news:csoffc$ev2$1@news.spamcop.net...
> D.F. Manno wrote:
> > In article
> > <responseguard-6AD6B8.18590517012005@news.cesmail.net>,
> > "Bob W." <responseguard@hotmail.com> wrote:
> >
> >> The problem is that your supposed "enlightenment" is, while
> >> possibly
> >> well-intentioned, is ill-conceived and badly ill-informed.
> >>
> >> Real child porn *is* being spamvertized.
> >>
> >> Those who get it are free to -- and should -- report it as
> >> such.
> >
> > That's all well and good, but I've noticed that all of the
> > places you
> > would report child porn to want you to give your identifying
> > information. And since mere possession of child porn is a
> > felony (at
> > least in the U.S.), wouldn't I be incriminating myself by
> > giving that
> > info?
>
> If you were hoarding/hosting it, yes.  Are you?  Your interest,
> in view of all the misinformation and rhetoric seems odd.
>

**
Actually, when you read any mail, it has to have been stored on your hard
drive in order for you to process it, if it is/has been on your hard drive,
then anyone (esp. the feds) can retrieve it and BINGO you are caught as
having "saved" something illegal on your hard drive  - and of course you
know what that means when the 'boys in blue' knock on your door.

--
A SpamCop user and forum reader,
Not Admin
***

> Pop
>


From buzzard554 at fastmail.co.uk  Thu Jan 20 18:29:13 2005
From: buzzard554 at fastmail.co.uk (Martin Edwards)
Date: Thu Jan 20 13:30:05 2005
Subject: [SC-Help] Re: Fake bounce defeats Spamcop (again)
Message-ID: <csot4j$o8j$1@news.spamcop.net>

I get these, and the poster's example have it in common with mine that 
the Return-path line is empty.  My guess is that that is the reason. 
Can someone more technically savvy than me help out here?
From MikeE at ster.invalid  Thu Jan 20 11:20:59 2005
From: MikeE at ster.invalid (Mike Easter)
Date: Thu Jan 20 14:20:02 2005
Subject: [SC-Help] Re: Fake bounce defeats Spamcop (again)
References: <csot4j$o8j$1@news.spamcop.net>
Message-ID: <csp07v$q9f$1@news.spamcop.net>

Martin Edwards wrote:
> I get these, and the poster's example have it in common with mine that
> the Return-path line is empty.  My guess is that that is the reason.
> Can someone more technically savvy than me help out here?

What was posted in spam [partial snippage below] looks like a bounce
header without the bounced mail body.

If you want to talk about yours, you should post its tracker.

David Purdy wrote:
> Return-Path: <>
> From: Mail Administrator <Postmaster@mailhost.ntl.com>
> Reply-To: <Postmaster@mailhost.ntl.com>
> Content-Type: multipart/report;
>   report-type=delivery-status;
>   Boundary="===========================_ _= 5283508(26517)1106169977"


-- 
Mike Easter
kibitzer, not SC admin

From bclee at spamcop.net  Thu Jan 20 20:34:03 2005
From: bclee at spamcop.net (Brian Lee)
Date: Thu Jan 20 23:35:03 2005
Subject: [SC-Help] Re: Are Spam submissions by e-mail working?
In-Reply-To: <csko98$8b8$1@news.spamcop.net>
References: <Xns95C091AC24F93greenriverordinance@216.154.195.61>
	<csjs9i$n3k$1@news.spamcop.net> <csko98$8b8$1@news.spamcop.net>
Message-ID: <csq0ns$gb1$1@news.spamcop.net>

WazoO wrote (in part):
> 
> The Forum FAQ has a number of entries on these e-mail issues.
> http://forum.spamcop.net/forums/

Two discoveries today:

(1) Less than 20% of the spam reports I email to spamcop from the old 
SMTP server seem to get there.  So far 100% of the reports I've sent 
from a new SMTP server have gone through.  Hmmm.

(2) I know the ISP for the old SMTP server uses BrightMail spam filters 
on incoming email.  After reading your post on BrightMail on the forums, 
I'll bet they are using them on outgoing email too, even though the 
first response I got claimed they were not.  I've pinged them again . . 
. I'll let you know what I find out but at the moment it seems pretty 
clear.  (Actually this would not be the first time I've found a 
problem/unexpected "feature" in their BrightMail configuration for them.)

Thanks for your help.
From wb8tyw at qsl.network  Fri Jan 21 08:02:49 2005
From: wb8tyw at qsl.network (John E. Malmberg)
Date: Fri Jan 21 09:05:03 2005
Subject: [SC-Help] Re: Validating SMTP addresses
References: <csgbrt$iuv$1@news.spamcop.net>
	<Xns95E144A99A58Eblammo@216.154.195.61> <cslpvh$q69$1@news.spamcop.net>
Message-ID: <IaHG3d9HE+yJ@eisner.encompasserve.org>

In article <csns3h$48i$1@news.spamcop.net>,
"Iain" <ipmarketing@spamcop.net> writes:
>
> I guess really, realising that every ISP can be set-up differently, I'm
> hoping for some guidance on likely normal behaviour (the 80-90% behaviour).
> Sounds like your belief is that would be a 5xx response at send time which
> is good and seems a more reliable method of detecting an address is no
> longer valid. That means that parsing any NDR replies to extract info is
> less critical which is good as my presumption is:

I have seen header items in mailing lists that direct errors to a special
e-mail address.  I do not know if they are standard items.  If you can
take advantage of that, then you do not have to parse the NDR code, anything
to that e-mail address is probably an NDR or spam/virus, and occasionally a
confused user.

> 1. The precise format of NDRs varies making them harder to grep. Even
> response codes could be in the form 511 or 5.1.1 so not even consistency
> there :-(

The good news is that you do not have to parse them if they contain the
rejected e-mail.  Just look for your header information in the body of the
message and assume that the only reason you would get your own message back is
an NDR.

The other thing that will interfere with your mailings is a system known as
challenge-response.  In that case, the receiving mail server usually accepts
the message, and then sends a challenge to the sender, and the receiver will
not get your message until someone answers the challenge.  So for each spam in
from a unique e-mail address, some victim gets a challenge.

But for mailing lists, nothing will answer a challenge as they are more varied
in format than an NDR is.  And because a spammer that is U.S. CAN-SPAM
compliant can easily set up an automation to answer common challenges, some of
the systems require a human to read a graphics image and key in what they see.
Of course the spammers can defeat that by including that link in their spam,
claiming that answering the question will deliver a prize.  Some fool will fall
for it.

And some of the challenge response systems are broken and will not pass the
messge through even if the challenge is answered.  I know of at least one of
mail server where that appears to be the case, and it looks like it is for a
military installation.  It appears that there is no way for one of their users
to receive e-mails from a list that they signed up on, or for that user to
realize that.

So you must make it clear that you will not be able to answer challenges.


If an ISP the size of AOL has learned that it is very bad for their business to
send NDRs instead of using SMTP reject codes, it is a strong indication that it
is very bad for everyone else.  You will probably find that most mail servers
know better than to accept mail to non-existant e-mail addresses, and a number
of the ones that do will just silently delete message, because they know that
an NDR probably has over a 99% chance of being caused by spam or a virus which
means that the NDR sender would be assisting in mail bombing some innocent
victim.

There are or have been I.P. addresses on the conservative spamhaus.org DNSbl
specifically because they are sending large quantities of NDRs to forged
addresses because they are using an anti-spam appliance that was set up to do
that.

If I were running my own mail server, and I started getting NDRs from messages
that did not leave my server, If that was the only e-mail that I ever saw from
that domain name, I would probaly put that I.P. address in a local blocking
list and forget about it.  The same for mis-directed virus detected notices.

-John
wb8tyw@qsl.network
Personal Opinion Only

--
Out of office/Vaction e-mail responders and on voice mail messages are one of
the best ways to help a criminal steal from your company.  They are the
electronic equivalent to a pile of newspapers in front of your door.
From rogertracy at lycos.com  Fri Jan 21 06:51:05 2005
From: rogertracy at lycos.com (Roger Tracy)
Date: Fri Jan 21 09:51:15 2005
Subject: [SC-Help] 
 Spam reporting problem - TRACKING URL - http://www.spamcop.net/sc
 ?id=z717047346z8f996204f9b7d62cf0556e980e1683a9z
Message-ID: <20050121145105.A600ACA06F@ws7-4.us4.outblaze.com>

This spam submission does not complete the Spamcop analysis process:

TRACKING URL -
http://www.spamcop.net/sc?id=z717047346z8f996204f9b7d62cf0556e980e1683a9z


Here's what I'm getting:

View entire message
Parsing header:

Received:  from 217.78.11.47 (HELO 67.28.114.36) (217.78.11.47) by 
mta205.mail.dcn.yahoo.com with SMTP; Thu, 20 Jan 2005 09:49:50 -0800
Bogus IP in HELO removed:
Received: from 217.78.11.47 (
HELO [x.x.x.x]
) (217.78.11.47) by mta205.mail.dcn.yahoo.com with SMTP; Thu, 20 Jan 
2005 09:49:50 -0800
217.78.11.47 found
host 217.78.11.47 (getting name) no name
Possible spammer: 217.78.11.47
Received line accepted

Received:  (qmail 7544 invoked by uid 790235); Thu, 20 Jan 2005 14:47:56 -0300
Removed 'by' from uid
Received:  (qmail 7544 invoked (uid 790235)); Thu, 20 Jan 2005 14:47:56 -0300
no from
Ignored
Tracking message source: 217.78.11.47:
Routing details for 217.78.11.47
[refresh/show] Cached whois for 217.78.11.47 : mdk@internet-ireland.ie
Using last resort contacts mdk@internet-ireland.ie
Message is 20 hours old
217.78.11.47 not listed in dnsbl.njabl.org
217.78.11.47 not listed in dnsbl.njabl.org
217.78.11.47 listed in cbl.abuseat.org ( 127.0.0.2 )
217.78.11.47 is an open proxy
217.78.11.47 not listed in query.bondedsender.org
217.78.11.47 not listed in iadb.isipp.com
Finding links in message body
Recurse multipart:
    Parsing HTML part
Reducing redundant links for b4reliquary136.juharistolato.com
Resolving link obfuscation
http://fencepost.coffman321..org
http://hemisphere.bookie65..info
http://hoyt.implacable3355..co.uk
http://potentiometer.refer7418..info
http://cartographer.hollister1480..org
http://neurology.calder7210..com
http://deity.regiment2602..us

got sigalarm, taking too long to process, aborted.
    Perhaps you can wait a few minutes and reload?
-- 
_______________________________________________
Find what you are looking for with the Lycos Yellow Pages
http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.asp?SRC=lycos10

From ipmarketing at spamcop.net  Fri Jan 21 16:33:01 2005
From: ipmarketing at spamcop.net (Iain)
Date: Fri Jan 21 11:35:02 2005
Subject: [SC-Help] Re: Validating SMTP addresses
References: <csgbrt$iuv$1@news.spamcop.net>
	<Xns95E144A99A58Eblammo@216.154.195.61> <cslpvh$q69$1@news.spamcop.net>
	<IaHG3d9HE+yJ@eisner.encompasserve.org>
Message-ID: <csras6$8he$1@news.spamcop.net>


"John E. Malmberg" <wb8tyw@qsl.network> wrote in message 
news:IaHG3d9HE+yJ@eisner.encompasserve.org...
> In article <csns3h$48i$1@news.spamcop.net>,
> "Iain" <ipmarketing@spamcop.net> writes:

Thanks for these thought John. Some very good points. Now to try and boil 
this all down to something meaningful! :-)

Thanks again for your help.../Iain 


From MikeE at ster.invalid  Fri Jan 21 08:36:06 2005
From: MikeE at ster.invalid (Mike Easter)
Date: Fri Jan 21 11:35:09 2005
Subject: [SC-Help] Re: Spam reporting problem
References: <mailman.67.1106319076.4572.spamcop-help@news.spamcop.net>
Message-ID: <csraum$8i2$1@news.spamcop.net>

subject shortened

Roger Tracy wrote:
> This spam submission does not complete the Spamcop analysis process:
>
> TRACKING URL -
www.spamcop.net/sc?id=z717047346z8f996204f9b7d62cf0556e980e1683a9z

SC is going off on a wild goose chase - chasing 'invisible' and
insignificant contained links.

> Tracking message source: 217.78.11.47:

> Using last resort contacts mdk@internet-ireland.ie

That source should be named and it is currently on the SCbl and other
lists.

> Finding links in message body
> Recurse multipart:
>     Parsing HTML part
> Reducing redundant links for b4reliquary136.juharistolato.com

The numerous redundant links for juharistolato at 200.146.101.107

whois -h whois.registro.br 200.146.101.107 ...
person:      GVT - Operacoes Internet
e-mail:      abuse@GVT.NET.BR
inetnum:     200.146.101/24

are all that matters, and it is spamhaused SBL22560

These below are 'junk' links.

> Resolving link obfuscation
> http://fencepost.coffman321..org
> http://hemisphere.bookie65..info
> http://hoyt.implacable3355..co.uk
> http://potentiometer.refer7418..info
> http://cartographer.hollister1480..org
> http://neurology.calder7210..com
> http://deity.regiment2602..us
>
> got sigalarm, taking too long to process, aborted.
>     Perhaps you can wait a few minutes and reload?

The strategy works.  SC has to bail and nothing gets reported.

-- 
Mike Easter
kibitzer, not SC admin

From Paul_Hwang at symantec.com  Sat Jan 22 03:02:04 2005
From: Paul_Hwang at symantec.com (Paul Hwang)
Date: Fri Jan 21 12:02:15 2005
Subject: [SC-Help] Paul Hwang is out of the office.
Message-ID: <OFDF89F478.CA51EA09-ONCA256F90.005D92E4-CA256F90.005D92E4@symantec.com>





I will be out of the office starting  22/01/2005 and will not return until
06/02/2005.

I will be on the United States west coast from Saturday, 22nd of January
2005 to Friday, 28th of February, 2005. During this time, I will be
available by e-mail on US Pacific time and wireless roaming. From Saturday
29th of January, 2005 to Sunday 6th of February I will be on the United
States east coast and will be available by e-mail intermittently.

For urgent matters, please call my cellular phone on +61-410-473-845.
Alternatively, for contacts in Australia and New Zealand, please contact
Lachlan Everett, Andrew Gordon or Ken Hogg for any Symantec Brightmail
sales enquiries (+61-2-8879-5600). For BLOC enquires, please contract
Trevor Young on +886-2-8723-9924.

For other contacts in Asia, please contact

Beijing: +86-10-8518-3338
Hong Kong: +852-2528-6206
India: +91-22-2657-0658
Korea: +82-2-3420-8600
Malaysia: +60-3-7805-4910
Singapore: +656-6239-2000
Taiwan: +886-2-8267-5800

Thank you kindly,

Paul Hwang

********************************************************
Paul Hwang Esq CPA MCP MCSE
APAC Business Intelligence
Symantec Corporation
Office:     +61-2-8879-1162
Interoffice:      6 [620] 1162
Cell Phone:       +61-410-473-845
Email:      paul_hwang@symantec.com
Web:  http://www.symantec.com
Yahoo ID:   paulpowie
Address:    301 Howard Street, Suite 1800 San Francisco, CA 94105, USA


This message (including any attachments) is intended only for the use of
the individual or entity to which it is addressed and may contain
information that is non-public, proprietary, privileged, confidential, and
exempt from disclosure under applicable law or may constitute as attorney
work product. If you are not the intended recipient, you are hereby
notified that any use, dissemination, distribution, or copying of this
communication is strictly prohibited. If you have received this
communication in error, notify us immediately by telephone and (i) destroy
this message if a facsimile or (ii) delete this message immediately if this
is an electronic communication. Thank you.

From firewoman at default.domain.not.available  Fri Jan 21 13:05:18 2005
From: firewoman at default.domain.not.available (Firewoman)
Date: Fri Jan 21 13:05:03 2005
Subject: [SC-Help] Re: Paul Hwang is out of the office.
References: <mailman.68.1106326937.4572.spamcop-help@news.spamcop.net>
Message-ID: <csrg52$c83$1@news.spamcop.net>

"Paul Hwang" <Paul_   Hw   ang (at) symantec.com> wrote in message 
news:mailman.68.1106326937.4572.spamcop-help@news.spamcop.net...
>
>
>
>
> I will be out of the office starting  22/01/2005 and will not return until
> 06/02/2005.

<Snip auto-responding vacation announcement.>



> Web:  http://www.symantec.com

Shouldn't SOMEONE at Symantec know by now that vacation messages and 
autoresponders are the devil?  Espcially an MCA/MCSE???

:-) 


From rogertracy at lycos.com  Fri Jan 21 13:53:47 2005
From: rogertracy at lycos.com (Roger Tracy)
Date: Fri Jan 21 18:36:03 2005
Subject: [SC-Help] Re: Spam reporting problem
Message-ID: <20050121215347.B894D86B0D@ws7-1.us4.outblaze.com>

Tks for your help.  If I'm reading your message correctly, I should forward a copy of the spam to abuse@GVT.NET.BR with my complaint to have the spamming account closed down.  

Am I correct in thinking that mdk@internet-ireland.ie is providing the information on the spammer and should not be contacted regarding the complaint?

Tks again,

Dan Tracy
rogertracy@lycos.com


----- Original Message -----
From: "Mike Easter" <MikeE@ster.invalid>
To: dan <rogertracy@lycos.com>
Subject: [SC-Help] Re: Spam reporting problem
Date: Fri, 21 Jan 2005 08:36:06 -0800

> 
> subject shortened
> 
> Roger Tracy wrote:
> > This spam submission does not complete the Spamcop analysis process:
> >
> > TRACKING URL -
> www.spamcop.net/sc?id=z717047346z8f996204f9b7d62cf0556e980e1683a9z
> 
> SC is going off on a wild goose chase - chasing 'invisible' and
> insignificant contained links.
> 
> > Tracking message source: 217.78.11.47:
> 
> > Using last resort contacts mdk@internet-ireland.ie
> 
> That source should be named and it is currently on the SCbl and other
> lists.
> 
> > Finding links in message body
> > Recurse multipart:
> >     Parsing HTML part
> > Reducing redundant links for b4reliquary136.juharistolato.com
> 
> The numerous redundant links for juharistolato at 200.146.101.107
> 
> whois -h whois.registro.br 200.146.101.107 ...
> person:      GVT - Operacoes Internet
> e-mail:      abuse@GVT.NET.BR
> inetnum:     200.146.101/24
> 
> are all that matters, and it is spamhaused SBL22560
> 
> These below are 'junk' links.
> 
> > Resolving link obfuscation
> > http://fencepost.coffman321..org
> > http://hemisphere.bookie65..info
> > http://hoyt.implacable3355..co.uk
> > http://potentiometer.refer7418..info
> > http://cartographer.hollister1480..org
> > http://neurology.calder7210..com
> > http://deity.regiment2602..us
> >
> > got sigalarm, taking too long to process, aborted.
> >     Perhaps you can wait a few minutes and reload?
> 
> The strategy works.  SC has to bail and nothing gets reported.
> 
> --
> Mike Easter
> kibitzer, not SC admin
> 
> _______________________________________________
> SpamCop-Help mailing list
> SpamCop-Help@news.spamcop.net
> http://news.spamcop.net/mailman/listinfo/spamcop-help

-- 
_______________________________________________
Find what you are looking for with the Lycos Yellow Pages
http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.asp?SRC=lycos10

From nobody at spamcop.net  Fri Jan 21 20:39:32 2005
From: nobody at spamcop.net (Pop)
Date: Fri Jan 21 20:40:04 2005
Subject: [SC-Help] Re: Forced perspective spam
References: <csh3tn$2r4$1@news.spamcop.net>
	<21384-41EC703C-267@storefull-3212.bay.webtv.net>
	<responseguard-6AD6B8.18590517012005@news.cesmail.net>
	<dfm2a3l0t2-AB711F.20373519012005@news.cesmail.net>
	<csoffc$ev2$1@news.spamcop.net>
	<responseguard-23A438.13160820012005@news.cesmail.net>
Message-ID: <cssasi$tij$1@news.spamcop.net>

Bob W. wrote:
> In article <csoffc$ev2$1@news.spamcop.net>, "Pop" 
> <nobody@spamcop.net>
> wrote:
>
>> D.F. Manno wrote:
>>> In article
>>> <responseguard-6AD6B8.18590517012005@news.cesmail.net>,
>>> "Bob W." <responseguard@hotmail.com> wrote:
>>>
>>>> The problem is that your supposed "enlightenment" is, while
>>>> possibly
>>>> well-intentioned, is ill-conceived and badly ill-informed.
>>>>
>>>> Real child porn *is* being spamvertized.
>>>>
>>>> Those who get it are free to -- and should -- report it as
>>>> such.
>>>
>>> That's all well and good, but I've noticed that all of the
>>> places you
>>> would report child porn to want you to give your identifying
>>> information. And since mere possession of child porn is a
>>> felony (at
>>> least in the U.S.), wouldn't I be incriminating myself by
>>> giving that
>>> info?
>>
>> If you were hoarding/hosting it, yes.  Are you?  Your 
>> interest,
>> in view of all the misinformation and rhetoric seems odd.
>
> Your post, in view of the fact that DF is a regular here, seems 
> like
> trolling.
>
> Are you?

Nope.

How about you?  I don't care if he's been here since day one; 
misinformation and such attempts at starting OT conversations 
don't belong here.  DF is  a "regular", agreed; that does not 
make him good, bad, or indifferent.  It means the initials have 
been used and that's all.
   I"ve seen you around now and then for quite awhile too, but 
... to my knowledge, you show a lot more intelligence and 
attention to truthful non-confrontational situation creation than 
DF.

Let's get on to more meaningful topics and quit trying to 
posture.

Pop

From ric.gates at bigsleep.org  Sat Jan 22 04:28:45 2005
From: ric.gates at bigsleep.org (Blammo)
Date: Fri Jan 21 23:30:02 2005
Subject: [SC-Help] Re: Validating SMTP addresses
References: <csgbrt$iuv$1@news.spamcop.net>
	<Xns95E144A99A58Eblammo@216.154.195.61> <cslpvh$q69$1@news.spamcop.net>
	<Xns95E391E88DC8Ablammo@216.154.195.61> <csns3h$48i$1@news.spamcop.net>
Message-ID: <Xns95E5D06E2400Eblammo@216.154.195.61>

On 20 Jan 2005 Iain entered spamcop.help and left
news:csns3h$48i$1@news.spamcop.net: 

> 
> "Blammo" <ric.gates@bigsleep.org> wrote in message 
> news:Xns95E391E88DC8Ablammo@216.154.195.61...
>>
> 
> I'm not quite clear about what you mean? Does "any address that is
> checked will get added to a junk mailing list" refer to someone
> harvesting for the purposes of buillding a junk list? i.e. that the
> process of verifying the address at the MAIL TO enables someone to
> enumerate and so build a list? I'm just not quite with you...
> 

Yes, that's right, I don't mean all. I didn't state that very well. 

>>
> My apology here...I pointed you to the wrong article. As you say, this
> one refers to a 'tar pit' setting to increasingly delay the SMTP
> response to a sender and so bog down someone address harvesting, but
> ultimately returns an in-session 5xx response. I should have referred
> to http://support.microsoft.com/?kbid=304897. Again this is an MS
> article (about preventing relaying) but I'm presuming the logic is
> shows need not be exclusive to MS product. What this article mentions
> is: 
> 
> "some Microsoft SMTP products do not perform a directory lookup before
> they accept SMTP e-mail messages for delivery"
> 

Yes, this is a common problem, especially for large servers.

>  The important point though is: "If a mail server accepts
> a message and then later decides that it cannot deliver the message,
> the server must generate an NDR". So then the only rejection is an
> NDR. The send will actually be accepted 250 ok
> 

And some servers may discard the message if they think it is spam, if it's 
in a block list, or they think it contains a virus. Of course an end user 
spam filter may do that as well.

> 
> I guess really, realising that every ISP can be set-up differently,
> I'm hoping for some guidance on likely normal behaviour (the 80-90%
> behaviour). Sounds like your belief is that would be a 5xx response at
> send time which is good and seems a more reliable method of detecting
> an address is no longer valid. That means that parsing any NDR replies
> to extract info is less critical which is good as my presumption is:
> 
> 1. The precise format of NDRs varies making them harder to grep. Even 
> response codes could be in the form 511 or 5.1.1 so not even
> consistency there :-(
> 
> 2. Some ISPs may not send NDRs although I guess in that case they
> should be giving an immediate 5xx during the mail send?
> 

*Should* be, but unfortunately for those who don't abuse, you never know.
you could possibly send a SINGLE test message to see what kind of response 
you get. I'm not sure if this is a practical suggestion, as I see spammers 
do this as well. But maybe something to consider.

I like to require some other information as well, and address or phone 
number, the name of their ISP. This of course depends on the context, but 
may give you something else to validate along with the eMail address and 
IP.
-- 
| Ric
|
From ric.gates at bigsleep.org  Sat Jan 22 04:40:10 2005
From: ric.gates at bigsleep.org (Blammo)
Date: Fri Jan 21 23:45:04 2005
Subject: [SC-Help] Re: Paul Hwang is out of the office.
References: <mailman.68.1106326937.4572.spamcop-help@news.spamcop.net>
	<csrg52$c83$1@news.spamcop.net>
Message-ID: <Xns95E5D25E427D6blammo@216.154.195.61>

On 21 Jan 2005 Firewoman entered spamcop.help and left 
news:csrg52$c83$1@news.spamcop.net:

> Shouldn't SOMEONE at Symantec know by now that vacation messages and 
> autoresponders are the devil?  Espcially an MCA/MCSE???
> 

I destroyed the message as suggested, but I can't call because he is out of 
the office, darn!

-- 
| Ric
|
From agent01413 at my-deja.com  Sat Jan 22 06:39:35 2005
From: agent01413 at my-deja.com (Socks)
Date: Sat Jan 22 01:40:03 2005
Subject: [SC-Help] Re: Paul Hwang is out of the office.
References: <mailman.68.1106326937.4572.spamcop-help@news.spamcop.net>
Message-ID: <Xns95E5F0A59D899agent01413MYDEJACOM@216.154.195.61>

Paul Hwang <Paul_Hwang@symantec.com> wrote in
news:mailman.68.1106326937.4572.spamcop-help@news.spamcop.net: 

> I will be out of the office starting  22/01/2005 and will not return
> until 06/02/2005.
> 

(snip)

> ********************************************************
> Paul Hwang Esq CPA MCP MCSE

MCSE.  How'd I guess.
From wb8tyw at qsl.network  Sat Jan 22 01:44:06 2005
From: wb8tyw at qsl.network (John E. Malmberg)
Date: Sat Jan 22 01:45:03 2005
Subject: [SC-Help] Re: Paul Hwang is out of the office.
In-Reply-To: <Xns95E5D25E427D6blammo@216.154.195.61>
References: <mailman.68.1106326937.4572.spamcop-help@news.spamcop.net>
	<csrg52$c83$1@news.spamcop.net> <Xns95E5D25E427D6blammo@216.154.195.61>
Message-ID: <csssnm$9e0$1@news.spamcop.net>

Blammo wrote:
> On 21 Jan 2005 Firewoman entered spamcop.help and left 
> news:csrg52$c83$1@news.spamcop.net:
> 
>>Shouldn't SOMEONE at Symantec know by now that vacation messages and 
>>autoresponders are the devil?  Espcially an MCA/MCSE???
>>
> I destroyed the message as suggested, but I can't call because he is out of 
> the office, darn!

The other question is how much emergency shipped items and purchasing or 
computer access can be ordered by him by phone when he is out of the office?

That message has just told every con-artist on the internet how long 
they can spoof his identity against his own company with a reasonable 
chance of getting away with it.

One convicted criminal admitted getting pre-production and secret 
prototypes that way.  Also technical manuals that showed him how to 
break into the systems that the company used internally.

A U.S. TV news show some years back demonstrated to the horror of the 
company executive that authorized the test how easy it was to get his 
help desk to give the private investigator everything that he needed to 
dial and log into an executive level account on their computer.  The 
executive thought that the test would be a technological attack, not 
just calling and asking to be let in.

Any company that cares about their corporate security should put an 
absolute ban on letting such auto-responders send messages out side of 
their company, and not allow such messages on voice mail.

After all, the criminals have been using these vacation messages to 
steal for over a decade now, so this is not a new exploit.  Some 
estimates are that it is one of the most common ways of stealing from 
medium to large companies.

To see it come from a company that is supposed to be selling security 
products does not look good for them.

Of course it could be a joe-job where someone is trying to make that 
company look bad.

-John
wb8tyw@qsl.network
Personal Opinion Only


From ric.gates at bigsleep.org  Sat Jan 22 07:40:26 2005
From: ric.gates at bigsleep.org (Blammo)
Date: Sat Jan 22 02:45:06 2005
Subject: [SC-Help] Re: Paul Hwang is out of the office.
References: <mailman.68.1106326937.4572.spamcop-help@news.spamcop.net>
	<csrg52$c83$1@news.spamcop.net> <Xns95E5D25E427D6blammo@216.154.195.61>
	<csssnm$9e0$1@news.spamcop.net>
Message-ID: <Xns95E5F0EDE7FC4blammo@216.154.195.61>

On 21 Jan 2005 John E. Malmberg entered spamcop.help and left 
news:csssnm$9e0$1@news.spamcop.net:

> Of course it could be a joe-job where someone is trying to make that 
> company look bad.
> 

Good point, but would MailMan accept it?

-- 
| Ric
|
From MikeE at ster.invalid  Sat Jan 22 00:02:40 2005
From: MikeE at ster.invalid (Mike Easter)
Date: Sat Jan 22 03:05:07 2005
Subject: [SC-Help] Re: Spam reporting problem
References: <mailman.69.1106350530.4572.spamcop-help@news.spamcop.net>
Message-ID: <cst17t$c5u$1@news.spamcop.net>

Restructured into conversational inline contextualized.

Roger Tracy wrote:
> From: "Mike Easter"
>> Roger Tracy wrote:
>>> This spam submission does not complete the Spamcop analysis process:
>>>
>>> TRACKING URL -
>> www.spamcop.net/sc?id=z717047346z8f996204f9b7d62cf0556e980e1683a9z
>>
>> SC is going off on a wild goose chase - chasing 'invisible' and
>> insignificant contained links.

>>> Tracking message source: 217.78.11.47:
>>
>>> Using last resort contacts mdk@internet-ireland.ie
>>
>> That source should be named and it is currently on the SCbl and other
>> lists.

> Am I correct in thinking that mdk@internet-ireland.ie is providing
> the information on the spammer and should not be contacted regarding
> the complaint?

No, that is not correct.  That is the address SpamCop would use to
contact about the source.  It is based on the following information
about the source IP

whois -h whois.ripe.net 217.78.11.47 ...
inetnum:      217.78.0.0 - 217.78.15.255
descr:        Internet Ireland Limited.
admin-c:      MDK7-RIPE = mdk@internet-ireland.ie
tech-c:       JS11601-RIPE =  n/a

No abuse address is registered with abuse.net

>> The numerous redundant links for juharistolato at 200.146.101.107
>>
>> whois -h whois.registro.br 200.146.101.107 ...
>> person:      GVT - Operacoes Internet
>> e-mail:      abuse@GVT.NET.BR
>> inetnum:     200.146.101/24
>>
>> are all that matters, and it is spamhaused SBL22560

> Tks for your help.  If I'm reading your message correctly, I should
> forward a copy of the spam to abuse@GVT.NET.BR with my complaint to
> have the spamming account closed down.

Yes, if you were making a manual report, you would address it to
mdk@internet-ireland.ie about the spamsource 217.78.11.47 no rDNS which
is on multiple lists including spamcop's for spamtraps and also probably
abused proxy -- as well as abuse@gvt.net.br about
b4reliquary136.juharistolato.com DNS 200.146.101.107 for the
spamvertising.


-- 
Mike Easter
kibitzer, not SC admin

From ric.gates at bigsleep.org  Sat Jan 22 08:22:07 2005
From: ric.gates at bigsleep.org (Blammo)
Date: Sat Jan 22 03:25:03 2005
Subject: [SC-Help] Re: Paul Hwang is out of the office.
References: <mailman.68.1106326937.4572.spamcop-help@news.spamcop.net>
	<csrg52$c83$1@news.spamcop.net> <Xns95E5D25E427D6blammo@216.154.195.61>
	<csssnm$9e0$1@news.spamcop.net> <Xns95E5F0EDE7FC4blammo@216.154.195.61>
Message-ID: <Xns95E63DA721B2blammo@216.154.195.61>

On 21 Jan 2005 Blammo entered spamcop.help and left 
news:Xns95E5F0EDE7FC4blammo@216.154.195.61:

> Good point, but would MailMan accept it?
> 

Looks like there are several options for both list managers and members 
that deal with this problem...

http://staff.imsa.edu/~ckolar/mailman/mailman-administration-v2.html

-- 
| Ric
From Kilgallen at SpamCop.net  Sat Jan 22 07:31:19 2005
From: Kilgallen at SpamCop.net (Larry Kilgallen)
Date: Sat Jan 22 08:35:03 2005
Subject: [SC-Help] Re: Paul Hwang is out of the office.
References: <mailman.68.1106326937.4572.spamcop-help@news.spamcop.net>
	<Xns95E5F0A59D899agent01413MYDEJACOM@216.154.195.61>
Message-ID: <yg6Rgii7mD2i@eisner.encompasserve.org>

In article <Xns95E5F0A59D899agent01413MYDEJACOM@216.154.195.61>, Socks <agent01413@my-deja.com> writes:
> Paul Hwang <Paul_Hwang@symantec.com> wrote in
> news:mailman.68.1106326937.4572.spamcop-help@news.spamcop.net: 
> 
>> I will be out of the office starting  22/01/2005 and will not return
>> until 06/02/2005.
>> 
> 
> (snip)
> 
>> ********************************************************
>> Paul Hwang Esq CPA MCP MCSE
> 
> MCSE.  How'd I guess.

Perhaps you are slow :-)

Esq in the same line is an earlier tipoff.
Even my lawyer does not use that.
From wgzkid502 at sneakemail.com  Sat Jan 22 09:41:38 2005
From: wgzkid502 at sneakemail.com (Alan Krueger)
Date: Sat Jan 22 10:45:04 2005
Subject: [SC-Help] Registration gone awry
Message-ID: <csts7e$qoq$1@news.spamcop.net>

For some reason, when I registered (not with this email address) via the 
"sign up for SpamCop reporting" page and followed the instructions, I 
ended up having an "ISP control center" and no reporting form.

This seems wrong for some reason.  Is there a way to fix this?
From anteperkovic at vip.hr  Sat Jan 22 09:01:34 2005
From: anteperkovic at vip.hr (anteperkovic@vip.hr)
Date: Sat Jan 22 12:05:03 2005
Subject: [SC-Help] Spamcop is really annoying!
Message-ID: <1106413294.280150.286500@c13g2000cwb.googlegroups.com>

I don't know WTF is spamcop but it generates more problems than spam!

I just tried to forward an email from one of my addresses to another
and I received this:


-------- Original Message --------
Subject: [spam?] Mail System Error - Returned Mail
Date: Sat, 22 Jan 2005 17:49:04 +0100
From: Mail Administrator <Postmaster@vip.hr>
Reply-To: <Postmaster@vip.hr>
To: CENSORED@vip.hr

This Message was undeliverable due to the following reason:

Each of the following recipients was rejected by a remote mail server.
The reasons given by the server are included to help you determine why
each recipient was rejected.

Recipient: <CENSORED.CENSORED@CENSORED.com>
Reason:    5.3.0 <CENSORED.CENSORED@CENSORED.com>... Email from
212.91.98.72 rejected - see
http://www.spamcop.net/w3m?action=checkblock&ip=212.91.98.72>


Please reply to tehnicka.podrska@vip.hr
if you feel this message to be in error.



...
This is really annoying and it heppaned 2 times in 3 days. What are
they trying to do? 

Make all the people stop using email?

Ante

From TJLWBECGSGWU at spammotel.com  Sat Jan 22 17:41:21 2005
From: TJLWBECGSGWU at spammotel.com (Mathew Hendry)
Date: Sat Jan 22 12:45:03 2005
Subject: [SC-Help] Re: Spamcop is really annoying!
References: <1106413294.280150.286500@c13g2000cwb.googlegroups.com>
Message-ID: <an25v0tpbb89l5jr3kst0a704nje7u96rk@4ax.com>

anteperkovic@vip.hr wrote in
<1106413294.280150.286500@c13g2000cwb.googlegroups.com>:

>I just tried to forward an email from one of my addresses to another
>and I received this:
>
>[snip]
>
>Please reply to tehnicka.podrska@vip.hr
>if you feel this message to be in error.

Better talk to them. Rejecting mail based solely on a SpamCop listing is not
a good idea unless you're happy to risk legitimate mail being blocked.

But, the mail server that was blocked does appear to have been sending to
spamtraps

http://www.spamcop.net/w3m?action=checkblock&ip=212.91.98.72

What is unclear is why the mail server itself, rather than the original
source of the spam, was implicated. Searching the abuse newsgroups, I see a
couple of reported (but very old) spams through that server, and it looks to
be adding legitimate Received: lines:

http://groups.google.co.uk/groups?scoring=d&q=212.91.98.72+group:*abuse*

-- Mat.

From MikeE at ster.invalid  Sat Jan 22 09:50:06 2005
From: MikeE at ster.invalid (Mike Easter)
Date: Sat Jan 22 12:50:03 2005
Subject: [SC-Help] Re: Spamcop is really annoying!
References: <1106413294.280150.286500@c13g2000cwb.googlegroups.com>
Message-ID: <csu3l9$vdk$1@news.spamcop.net>

anteperkovic@vip.hr wrote:
> I just tried to forward an email from one of my addresses to another
> and I received this:

> Email from
> 212.91.98.72 rejected - see
> http://www.spamcop.net/w3m?action=checkblock&ip=212.91.98.72>

That means that the IP 212.91.98.72  rDNS  fegkx2.vip.hr  is listed in
the SCbl and there is information at the link provided about that
subject

Causes of listing
System has sent mail to SpamCop spam traps in the past week

System administrator has already delisted this system once
Because of the above problems, express-delisting is not available

In the past 13.3 days, it has been listed 3 times for a total of 2.8
days

> This is really annoying and it heppaned 2 times in 3 days. What are
> they trying to do?

You are using an IP address 212.91.98.72 to try to send your mail which
is being named as a spamsource by an automatic system at spamcop which
is able to list IPs based on the fact that some kind of mail coming from
that IP address is hitting the spamtraps at spamcop.  There can be
causes of that problem which are not based on the IP address actually
being a spamsource.

Various providers such as the one for your
CENSORED.CENSORED@CENSORED.com use blocklists such as spamcop's to
defend themselves against spam problems.

The reporting addresses for that IP are postmaster@vip.hr &
abuse@vip.hr -- someone from those role accounts should be contacting SC
if they want to dispute the listing.  A deputy is the only one who can
look at spamtrap evidence


-- 
Mike Easter
kibitzer, not SC admin

From wb8tyw at qsl.network  Sat Jan 22 13:06:59 2005
From: wb8tyw at qsl.network (John E. Malmberg)
Date: Sat Jan 22 13:10:03 2005
Subject: [SC-Help] Re: Spamcop is really annoying!
In-Reply-To: <1106413294.280150.286500@c13g2000cwb.googlegroups.com>
References: <1106413294.280150.286500@c13g2000cwb.googlegroups.com>
Message-ID: <csu4o4$e3$1@news.spamcop.net>

anteperkovic@vip.hr wrote:
> I don't know WTF is spamcop but it generates more problems than spam!

Spamcop.net is a service that is used world wide by computer users to 
parse spam or other abusive e-mail and route the reports to the 
designated owners of the I.P. address it originated from.

When the abuse reports for an I.P. address exceed a percentage of the 
total e-mail seen from that I.P. address, it gets added to a blocking 
list so that other mail server operators and user's can use that 
information to prevent spam from getting to them.

When an I.P. address is on the spamcop.net list, my personal guess is 
that there is a over a 90% chance that most mail servers will only see 
spam or other abusive mail from it.

Rejecting e-mail at by I.P. address has proved to be the most accurate 
way of spam control, and the only way to convince some mail server 
operators to fix configuration problems with their mail servers.

No other method has shown to be effective for the majority of networks 
where abusive mail is allowed to be sent by the network owners.

This is a self help newsgroup that is being answered by anyone that 
happens to be reading it.

> I just tried to forward an email from one of my addresses to another
> and I received this:

 > http://www.spamcop.net/w3m?action=checkblock&ip=212.91.98.72>

Did you follow that link and look at it?

The repeated listings is an indication that there is a serious 
configuration problem with the computer at that I.P. address.  More 
detail used to be available, but spammers were using that information to 
know when to switch to another misconfigured computer to sent spam through.

Because of that, it will take either a paid spamcop.net member or a 
deputy to see what has been reported.


: Additional potential problems
: (these factors do not directly result in spamcop listing)
:
:    * System administrator has already delisted this system once
:
: Because of the above problems, express-delisting is not available
: Listing History
: In the past 13.3 days, it has been listed 3 times for a total of 2.8 : 
: days


: Parsing input: 212.91.98.72
: host 212.91.98.72 = fegkx2.vip.hr (cached)
: Routing details for 212.91.98.72
: [refresh/show] Cached whois for 212.91.98.72 : abuse@vip.hr
: Using abuse net on abuse@vip.hr
: abuse net vip.hr = postmaster@vip.hr, abuse@vip.hr
: Using best contacts postmaster@vip.hr abuse@vip.hr

You need to be contacting vip.hr to ask them what they are doing about 
the reports of spam they are receiving.

Apparently there is something misconfigured on that I.P. address, and 
instead of fixing the problem, they just requested a one time manual 
delisting.

http://ops.mail-abuse.com/cgi-bin/nph-ops-sview?212.91.98.72 shows what 
is probably wrong with the server.

> Received: from [212.91.98.72] by daver.bungi.com via sendmail with smtp;
> 	Thu, 13 Jan 2005 15:40:44 -0800 (PST)
> To: <removed>
> From: Mail Administrator <Postmaster@vip.hr>
> Reply-To: <Postmaster@vip.hr>
> Subject: Mail System Error - Returned Mail
> Date: Fri, 14 Jan 2005 00:40:43 +0100
> Message-ID: <20050113234043.KNSZ28216.fepkx2.vip.hr@fepkx2>
> MIME-Version: 1.0
> Content-Type: multipart/report;
> 		report-type=delivery-status;
> 		Boundary="===========================_ _= 1536560(28216)1105659643"
> 
> 
> --===========================_ _= 1536560(28216)1105659643
> Content-Type: text/plain
> 
> This Message was undeliverable due to the following reason:
> 
> The user(s) account is temporarily over quota.

Since 2003, a mail server at that I.P. address is abusively bouncing 
spam and viruses to the forged addresses contained in them, instead of 
using SMTP reject messages.

These bounces are effectively a denial of service attack against what 
ever mail server that the spam or virus has forged for it's run.

A mail server should respond with an SMTP 4xx status code during the 
SMTP transaction instead of accepting the e-mail and then generating a 
bounce when a user is over quota.

While the rules for SMTP mail servers allow such bounces, it is now 
almost universally recognized that such bounces are abusive and should 
not be done automatically.

It only takes a matter of minutes for a mail server that is bouncing 
spam to a forged address to fill up the quota of another innocent victim.

As long as this mail server is configured to bounce undeliverable 
messages instead of using SMTP status codes, you will find an increasing 
amount of networks that will reject e-mail from it, or have set their 
spam filters to automatically delete all e-mail from it silently, even 
after the spamcop.net listing expires.

Several more popular blocking lists than spamcop.net are now starting to 
list as mail servers that are abusively bouncing large amounts of mail 
to forged addresses.

The public evidence on the Internet indicates that your provider should 
have been aware of this problem since 2003.  You should find out from 
them when they plan to fix this problem.

-John
wb8tyw@qsl.network
Personal Opinion Only
From Kilgallen at SpamCop.net  Sat Jan 22 12:09:21 2005
From: Kilgallen at SpamCop.net (Larry Kilgallen)
Date: Sat Jan 22 13:10:12 2005
Subject: [SC-Help] Re: Spamcop is really annoying!
References: <1106413294.280150.286500@c13g2000cwb.googlegroups.com>
Message-ID: <6gaCZFjG+rr8@eisner.encompasserve.org>

In article <1106413294.280150.286500@c13g2000cwb.googlegroups.com>, anteperkovic@vip.hr writes:

> Please reply to tehnicka.podrska@vip.hr
> if you feel this message to be in error.
> 
> 
> 
> ...
> This is really annoying and it heppaned 2 times in 3 days. What are
> they trying to do? 
> 
> Make all the people stop using email?

No, actually they are trying to weed out those people who are smart
enough to reply to tehnicka.podrska@vip.hr like the instructions say.
From nobody at devnull.spamcop.net  Sat Jan 22 12:09:42 2005
From: nobody at devnull.spamcop.net (WazoO)
Date: Sat Jan 22 13:10:17 2005
Subject: [SC-Help] Re: Registration gone awry
References: <csts7e$qoq$1@news.spamcop.net>
Message-ID: <csu4t6$f3$1@news.spamcop.net>

"Alan Krueger" <wgzkid502@sneakemail.com> wrote in message
news:csts7e$qoq$1@news.spamcop.net...
> For some reason, when I registered (not with this email address) via the
> "sign up for SpamCop reporting" page and followed the instructions, I
> ended up having an "ISP control center" and no reporting form.
>
> This seems wrong for some reason.  Is there a way to fix this?

Contact Don at service at admin.spamcop.net with enough
detail to convince that you are the account holder.  Bits
can be flipped.



From wb8tyw at qsl.network  Sat Jan 22 13:14:59 2005
From: wb8tyw at qsl.network (John E. Malmberg)
Date: Sat Jan 22 13:15:02 2005
Subject: [SC-Help] Re: Spamcop is really annoying!
In-Reply-To: <an25v0tpbb89l5jr3kst0a704nje7u96rk@4ax.com>
References: <1106413294.280150.286500@c13g2000cwb.googlegroups.com>
	<an25v0tpbb89l5jr3kst0a704nje7u96rk@4ax.com>
Message-ID: <csu574$t0$1@news.spamcop.net>

Mathew Hendry wrote:
>> 
> What is unclear is why the mail server itself, rather than the original
> source of the spam, was implicated. Searching the abuse newsgroups, I see a
> couple of reported (but very old) spams through that server, and it looks to
> be adding legitimate Received: lines:

Look at the MAPS OPS evidence.

One or more of their users is over quota.

Apparently the mail server does not use the conservative DNSbls or has 
any other effective spam filtering, so spam will rapidly fill up any 
user's inbox.

So every spam in to an over quota user means a mailbombing of what ever 
e-mail address was forged.

With current spam delivery attempt rates measured at 80% of the e-mail 
traffic on the internet, that means any server that is generating 
bounces in response to undeliverable spam is generating an extreme 
amount of back-scatter traffic to other spam victims.

The spamcop.net listing is probably the least of the user's e-mail problems.

 From monitoring other forums, my guess is that this mail server is now 
in the local blocking lists of at least two U.S. based ISPs, and some of 
them will block the entire ISP when they get a bounce flood.

-John
wb8tyw@qsl.network
Personal Opinion Only
From nobody at spamcop.net  Sat Jan 22 15:13:13 2005
From: nobody at spamcop.net (Pop)
Date: Sat Jan 22 15:15:07 2005
Subject: [SC-Help] Re: Spamcop is really annoying!
References: <1106413294.280150.286500@c13g2000cwb.googlegroups.com>
	<6gaCZFjG+rr8@eisner.encompasserve.org>
Message-ID: <csuc4n$4tn$1@news.spamcop.net>

Larry Kilgallen wrote:
> In article 
> <1106413294.280150.286500@c13g2000cwb.googlegroups.com>,
> anteperkovic@vip.hr writes:
>> Please reply to tehnicka.podrska@vip.hr
>> if you feel this message to be in error.
 ...
>> This is really annoying and it heppaned 2 times in 3 days. 
>> What are
>> they trying to do?
>> Make all the people stop using email?
> No, actually they are trying to weed out those people who are 
> smart
> enough to reply to tehnicka.podrska@vip.hr like the 
> instructions say.

The several clear and concise responses to this OP look to me 
like a great little mini-FAQ that could be posted periodically on 
the groups.

I -knew- all that (after I read it), but I never could have 
explained it so clearly or easily.  Anyone looking for material, 
here's a great start, IMO.

Pop

From nobody at spamcop.net  Sat Jan 22 15:15:02 2005
From: nobody at spamcop.net (Pop)
Date: Sat Jan 22 15:15:14 2005
Subject: [SC-Help] Re: Registration gone awry
References: <csts7e$qoq$1@news.spamcop.net> <csu4t6$f3$1@news.spamcop.net>
Message-ID: <csuc83$4u9$1@news.spamcop.net>

WazoO wrote:
> "Alan Krueger" <wgzkid502@sneakemail.com> wrote in message
> news:csts7e$qoq$1@news.spamcop.net...
>> For some reason, when I registered (not with this email 
>> address) via
>> the "sign up for SpamCop reporting" page and followed the
>> instructions, I ended up having an "ISP control center" and no
>> reporting form.
>>
>> This seems wrong for some reason.  Is there a way to fix this?
>
> Contact Don at service at admin.spamcop.net with enough
> detail to convince that you are the account holder.  Bits
> can be flipped.

Forgive me, but what's an "ISP control center" ?  Didn't see it 
in a FAQ; or is it something that's none of our business if we're 
free users?

Pop

From MikeE at ster.invalid  Sat Jan 22 12:23:52 2005
From: MikeE at ster.invalid (Mike Easter)
Date: Sat Jan 22 15:25:04 2005
Subject: [SC-Help] Re: Registration gone awry
References: <csts7e$qoq$1@news.spamcop.net> <csu4t6$f3$1@news.spamcop.net>
	<csuc83$4u9$1@news.spamcop.net>
Message-ID: <csuclj$58a$1@news.spamcop.net>

Pop wrote:
> Forgive me, but what's an "ISP control center" ?  Didn't see it
> in a FAQ; or is it something that's none of our business if we're
> free users?

The system mistakenly tho't the OP was signing up as an ISP admin rather
than regular user..

http://www.spamcop.net/w3m?action=ispsignupform  Please complete this
form to gain access to SpamCop ISP features:

-- 
Mike Easter
kibitzer, not SC admin

From nobody at spamcop.net  Sat Jan 22 15:32:23 2005
From: nobody at spamcop.net (Pop)
Date: Sat Jan 22 15:35:03 2005
Subject: [SC-Help] Thanks Mike E. Re: Registration gone awry
References: <csts7e$qoq$1@news.spamcop.net> <csu4t6$f3$1@news.spamcop.net>
	<csuc83$4u9$1@news.spamcop.net> <csuclj$58a$1@news.spamcop.net>
Message-ID: <csud8m$5ki$2@news.spamcop.net>

Mike Easter wrote:
> Pop wrote:
>> Forgive me, but what's an "ISP control center" ?  Didn't see 
>> it
>> in a FAQ; or is it something that's none of our business if 
>> we're
>> free users?
>
> The system mistakenly tho't the OP was signing up as an ISP 
> admin
> rather than regular user..
>
> http://www.spamcop.net/w3m?action=ispsignupform  Please 
> complete this
> form to gain access to SpamCop ISP features:


From TJLWBECGSGWU at spammotel.com  Sat Jan 22 21:10:35 2005
From: TJLWBECGSGWU at spammotel.com (Mathew Hendry)
Date: Sat Jan 22 16:15:03 2005
Subject: [SC-Help] Re: Registration gone awry
References: <csts7e$qoq$1@news.spamcop.net> <csu4t6$f3$1@news.spamcop.net>
	<csuc83$4u9$1@news.spamcop.net>
Message-ID: <3of5v0dbgmc8ckg3deair2vjv0v5ite9fu@4ax.com>

"Pop" <nobody@spamcop.net> wrote in <csuc83$4u9$1@news.spamcop.net>:

>WazoO wrote:
>> "Alan Krueger" <wgzkid502@sneakemail.com> wrote in message
>> news:csts7e$qoq$1@news.spamcop.net...
>>> For some reason, when I registered (not with this email 
>>> address) via
>>> the "sign up for SpamCop reporting" page and followed the
>>> instructions, I ended up having an "ISP control center" and no
>>> reporting form.
>>>
>>> This seems wrong for some reason.  Is there a way to fix this?
>>
>> Contact Don at service at admin.spamcop.net with enough
>> detail to convince that you are the account holder.  Bits
>> can be flipped.
>
>Forgive me, but what's an "ISP control center" ?  Didn't see it 
>in a FAQ; or is it something that's none of our business if we're 
>free users?

I'm not sure if it's available for free users or not. I got to it through

http://www.spamcop.net/fom-serve/cache/94.html

and signed up for my local IP range and my ISP's outgoing news servers, just
out of interest. The reports look like this:

[ SpamCop V1.401  ]
See footer for key to columns and other notes about this report.

-- SPAM SOURCE REPORT --
IP Address     Start/Duration Trap User Mole Simp Additional comments

  82.41.114.138  Jan 22 20h/0    1    0    0    0 
  82.41.100.106  Jan 22 20h/0    1    0    0    0 
   82.41.90.155  Jan 22 18h/5  271   12    1    0 
  82.41.114.164  Jan 22 18h/0    1    0    0    0 
   82.41.88.103  Jan 22 18h/0    6    1    0    0 
   82.41.83.179  Jan 22 18h/0    2    0    0    0 
  82.41.114.191  Jan 22 18h/0   87    6    0    0 
  82.41.100.135  Jan 22 11h/0   45    7    0    0 
[... tons more, sigh ...]

-- KEY TO COLUMNS --
IP Address:  The numeric address.
Start:       The first date (within the past week) that spam was 
             reported to have originated from the IP address.
Duration:    The duration of the incident in # of days
Trap:        Messages received at traps.
User:        Messages registered users have reported as spam.
Mole:        Messages submitted by registered users wishing to remain
             anonymous.
Simp:        Simple reports - messages submitted by unregistered users.

-- ADDITIONAL NOTES --
o  All times are GMT, exact time of incident withheld.
o  Time of this report is: Sat Jan 22 20:18:28 2005
o  To close an issue, or get more details, log into your account:
   http://www.spamcop.net/
o  Issues are sorted with the newest reports first.  Resolving new
   issues first heads off additional spam from in-progress sources.
o  This email is intended to be viewed with a fixed-width font.
o  This email was requested in your SpamCop preferences page - where
   it may be disabled.

-- Mat.

From nobody at devnull.spamcop.net  Sat Jan 22 15:38:59 2005
From: nobody at devnull.spamcop.net (WazoO)
Date: Sat Jan 22 16:40:03 2005
Subject: [SC-Help] Re: Registration gone awry
References: <csts7e$qoq$1@news.spamcop.net> <csu4t6$f3$1@news.spamcop.net>
	<csuc83$4u9$1@news.spamcop.net> <3of5v0dbgmc8ckg3deair2vjv0v5ite9fu@4ax.com>
Message-ID: <csuh5j$7vv$1@news.spamcop.net>

"Mathew Hendry" <TJLWBECGSGWU@spammotel.com> wrote in message
news:3of5v0dbgmc8ckg3deair2vjv0v5ite9fu@4ax.com...
>
> I'm not sure if it's available for free users or not. I got to it through
>
> http://www.spamcop.net/fom-serve/cache/94.html
>
> and signed up for my local IP range and my ISP's outgoing news servers,
just
> out of interest. The reports look like this:

Basically, this is the method/mode/FAQ change that
replaced what used to be the "Third-Party Notification"
request.


From nobody at devnull.spamcop.net  Sat Jan 22 15:42:58 2005
From: nobody at devnull.spamcop.net (WazoO)
Date: Sat Jan 22 16:45:03 2005
Subject: [SC-Help] Re: Spamcop is really annoying!
References: <1106413294.280150.286500@c13g2000cwb.googlegroups.com>
	<6gaCZFjG+rr8@eisner.encompasserve.org> <csuc4n$4tn$1@news.spamcop.net>
Message-ID: <csuhd2$8c3$1@news.spamcop.net>

"Pop" <nobody@spamcop.net> wrote in message
news:csuc4n$4tn$1@news.spamcop.net...
>
> The several clear and concise responses to this OP look to me
> like a great little mini-FAQ that could be posted periodically on
> the groups.
>
> I -knew- all that (after I read it), but I never could have
> explained it so clearly or easily.  Anyone looking for material,
> here's a great start, IMO.

Well as in most other newsgroups, there is a place you
can reference a lot of this data, add more data if you'd
like, correct data that exists .. and once again, how
hard is to simply point to either the FAQ on the
www.spamcop.net site or the much expanded
version over at http://forum.spamcop.net/forums/
that contains content developed by other SpamCop users?


From nobody at spamcop.net  Sat Jan 22 18:35:58 2005
From: nobody at spamcop.net (Pop)
Date: Sat Jan 22 18:40:05 2005
Subject: [SC-Help] Re: Spamcop is really annoying!
References: <1106413294.280150.286500@c13g2000cwb.googlegroups.com>
	<6gaCZFjG+rr8@eisner.encompasserve.org> <csuc4n$4tn$1@news.spamcop.net>
	<csuhd2$8c3$1@news.spamcop.net>
Message-ID: <csuo0r$c08$1@news.spamcop.net>

WazoO wrote:
> "Pop" <nobody@spamcop.net> wrote in message
> news:csuc4n$4tn$1@news.spamcop.net...
>>
>> The several clear and concise responses to this OP look to me
>> like a great little mini-FAQ that could be posted periodically 
>> on
>> the groups.
>>
>> I -knew- all that (after I read it), but I never could have
>> explained it so clearly or easily.  Anyone looking for 
>> material,
>> here's a great start, IMO.
>
> Well as in most other newsgroups, there is a place you
> can reference a lot of this data, add more data if you'd
> like, correct data that exists .. and once again, how
> hard is to simply point to either the FAQ on the
> www.spamcop.net site or the much expanded
> version over at http://forum.spamcop.net/forums/
> that contains content developed by other SpamCop users?


I don't disagree with you all that much.  Actually I was 
harkening back to a few days ago when some of the posters in this 
thread IIRC were discussing FAQs and various ideas on 
presentation.  Just being an opportunist, actually.

Pop




From ric.gates at bigsleep.org  Sun Jan 23 00:30:43 2005
From: ric.gates at bigsleep.org (Blammo)
Date: Sat Jan 22 19:35:09 2005
Subject: [SC-Help] Re: Spamcop is really annoying!
References: <1106413294.280150.286500@c13g2000cwb.googlegroups.com>
	<6gaCZFjG+rr8@eisner.encompasserve.org> <csuc4n$4tn$1@news.spamcop.net>
	<csuhd2$8c3$1@news.spamcop.net> <csuo0r$c08$1@news.spamcop.net>
Message-ID: <Xns95E6A813DC533blammo@216.154.195.61>

On 22 Jan 2005 Pop entered spamcop.help and left 
news:csuo0r$c08$1@news.spamcop.net:

> I don't disagree with you all that much.  Actually I was 
> harkening back to a few days ago when some of the posters in this 
> thread IIRC were discussing FAQs and various ideas on 
> presentation.  Just being an opportunist, actually.
> 

I agree with both of you. It wouldn't hurt to have a FAQ pointing to a FAQ 
pointing to another FAQ. Some people need all the help they can get, 
especially when they see that pretty much useless message about being 
blocked.

-- 
| Ric
|
From h9vzc2i02 at sneakemail.com  Sat Jan 22 16:38:02 2005
From: h9vzc2i02 at sneakemail.com (Anon_)
Date: Sat Jan 22 19:40:05 2005
Subject: [SC-Help] Info from sirs HQ
Message-ID: <csurlb$e3a$1@news.spamcop.net>

[Retransmitted from George Taylor]

from <dwight.sale@comcast.net»
Sun, 16 Jan 200522:56:37 -0000 dwight.sale@comcast.net
To:<2nggm3p02@sneakemail.com>
Date: Sun, 16 Jan 200514:51:41 -0800
To: SIR-HappeningsReadersT@Juno.com
From: Dwight Sale <dwight.sale@comcast.net>
Subject: SIR-Happenings .'

Hi SIR Happenings Readers,
Here is your personal copy of "SIR Happenings.
Editor Don MacGregor <dlm@foothill.net> and Production Manager John
Skarpelos <john@mediaart.com> have
done their usual superb job.
You will also find "Happenings" on the SIR website www.sirinc.org
Your comments are always welcome-
Dwight Sale
Database Mgr.
Sir Happenings Vol 2 Issue 1156.

(ps: The reason this looks strange is that he had to send it via USPS and
this is a scanned copy of the letter.

I have communicated back to him about the situation - e-mail/USPS confusion.

George)


From nobody at devnull.spamcop.net  Sat Jan 22 18:43:48 2005
From: nobody at devnull.spamcop.net (WazoO)
Date: Sat Jan 22 19:45:04 2005
Subject: [SC-Help] Re: Spamcop is really annoying!
References: <1106413294.280150.286500@c13g2000cwb.googlegroups.com>
	<6gaCZFjG+rr8@eisner.encompasserve.org> <csuc4n$4tn$1@news.spamcop.net>
	<csuhd2$8c3$1@news.spamcop.net> <csuo0r$c08$1@news.spamcop.net>
	<Xns95E6A813DC533blammo@216.154.195.61>
Message-ID: <csus04$ef7$1@news.spamcop.net>

"Blammo" <ric.gates@bigsleep.org> wrote in message
news:Xns95E6A813DC533blammo@216.154.195.61...
> On 22 Jan 2005 Pop entered spamcop.help and left
> news:csuo0r$c08$1@news.spamcop.net:
>
> I agree with both of you. It wouldn't hurt to have a FAQ pointing to a FAQ
> pointing to another FAQ. Some people need all the help they can get,
> especially when they see that pretty much useless message about being
> blocked.

I'm actually feeling a bit odd by some of the recent
discussion here.  I did post a request for input
following JT's offer of buying some software that
could be used to build a knowledgebase ...
apparently, my using the word FAQ in the
Subject Line put folks off from responding to
that.  Just strange that after all the years (and words)
over the years about "the FAQ sucks" .. an
opportunity is presented to try to work up an
item that could be better than what exists today,
and ....???? not a heck of a lot ...??

That said, the Forum structure was just changed today,
per user request.  The "How to....." Forum has some
postings in it to start the ball rolling ... as said before
and elsewhere, it may not be the best solution, but
there are a number of us actually trying to offer an
alternative ....

As far as "you've been blocked" ... Miss Betsy's entry
(both as a Pinned item and a Forum FAQ entry) sure
covers a lot of ground ....


From ric.gates at bigsleep.org  Sun Jan 23 06:25:31 2005
From: ric.gates at bigsleep.org (Blammo)
Date: Sun Jan 23 01:30:03 2005
Subject: [SC-Help] Re: Spamcop is really annoying!
References: <1106413294.280150.286500@c13g2000cwb.googlegroups.com>
	<6gaCZFjG+rr8@eisner.encompasserve.org> <csuc4n$4tn$1@news.spamcop.net>
	<csuhd2$8c3$1@news.spamcop.net> <csuo0r$c08$1@news.spamcop.net>
	<Xns95E6A813DC533blammo@216.154.195.61> <csus04$ef7$1@news.spamcop.net>
Message-ID: <Xns95E6E43B5BF71blammo@216.154.195.61>

On 22 Jan 2005 WazoO entered spamcop.help and left 
news:csus04$ef7$1@news.spamcop.net:

> I'm actually feeling a bit odd by some of the recent
> discussion here.  I did post a request for input
> following JT's offer of buying some software that
> could be used to build a knowledgebase ...

I think maybe I did miss that. I haven't looked at the web site FAQ lately, 
sorry, I was just going back to the subject about posting a FAQ in this 
group, even if it just pointed to a website FAQ.
Of course someone would have to be willing to post it on a regular bases, 
or... why couldn't it be automated?

-- 
| Ric
|
From nobody at spamcop.net  Sun Jan 23 08:59:38 2005
From: nobody at spamcop.net (Pop)
Date: Sun Jan 23 09:00:05 2005
Subject: [SC-Help] Re: Forced perspective spam
References: <csh3tn$2r4$1@news.spamcop.net>
	<21384-41EC703C-267@storefull-3212.bay.webtv.net>
	<responseguard-6AD6B8.18590517012005@news.cesmail.net>
	<dfm2a3l0t2-AB711F.20373519012005@news.cesmail.net>
	<csoffc$ev2$1@news.spamcop.net>
	<responseguard-23A438.13160820012005@news.cesmail.net>
	<cssasi$tij$1@news.spamcop.net>
	<responseguard-A95B95.21284622012005@news.cesmail.net>
Message-ID: <ct0ak6$am4$1@news.spamcop.net>

Bob W. wrote:
> In article <cssasi$tij$1@news.spamcop.net>, "Pop" 
> <nobody@spamcop.net>
> wrote:
>
> <snip>
>
>>> Your post, in view of the fact that DF is a regular here, 
>>> seems
...
>> How about you?  I don't care if he's been here since day one;
>> misinformation and such attempts at starting OT conversations
...
>
> I don't posture.
>
> I postulate-- that your asking DF whether he is hoarding child
> pornography was an attempt to provoke.
...
> So, please feel free can join the discussion.
>
> ...Without, if you will, intimating that by discussing the 
> subject, a
> poster is involved in child pornography.
>
> Thanks.


Bob W,

What can I say other than OK, I apologize to you and to the group 
for being off-track and intolerant.  I suspect somehow there is a 
"cultural" (only word I can think of) difference between myself 
and others in the discussion and I should have simply ignored 
what  thought bothered me.  The reason I say cultural, and I wish 
I could bring up the word I really want, is because when I went 
back and re-read the post I responded to, I still felt the same 
way, but ... that's just an excuse.  It may be that I haven't 
come to "know" DF as others have here, and thus I didn't pick up 
on nuances that the rest of you did.  Therefore, I bow to the 
knowledge and considerations of yourself and others and in the 
future I will attempt to be more thoughtful.
   I abhor provoking, trolling, whatever you want to call it, and 
I agree I may have seemed that way, especially on this group.

Thank you for your calm and firm response.  I do appreciate it, 
believe it or not.  I'm pretty tired and I know that's clumsily 
worded, but it's the best I can do for the moment.  Please accept 
my apologies to DF and the other participants.  I -do- see your 
point.

Pop




From nobody at spamcop.net  Sun Jan 23 09:10:13 2005
From: nobody at spamcop.net (Pop)
Date: Sun Jan 23 09:15:03 2005
Subject: [SC-Help] Re: Spamcop is really annoying!
References: <1106413294.280150.286500@c13g2000cwb.googlegroups.com>
	<6gaCZFjG+rr8@eisner.encompasserve.org> <csuc4n$4tn$1@news.spamcop.net>
	<csuhd2$8c3$1@news.spamcop.net> <csuo0r$c08$1@news.spamcop.net>
	<Xns95E6A813DC533blammo@216.154.195.61> <csus04$ef7$1@news.spamcop.net>
Message-ID: <ct0b81$b4t$1@news.spamcop.net>

WazoO wrote:
...
> I'm actually feeling a bit odd by some of the recent
> discussion here.  I did post a request for input
> following JT's offer of buying some software that
> could be used to build a knowledgebase ...
> apparently, my using the word FAQ in the
> Subject Line put folks off from responding to
> that.  Just strange that after all the years (and words)
> over the years about "the FAQ sucks" .. an
> opportunity is presented to try to work up an
> item that could be better than what exists today,
> and ....???? not a heck of a lot ...??

==>  That could be my fault as I'm the one brought it into this 
thread.  I meant to be taking advaatage of an opportunity, not 
creating confusion.
   I noticed there were far fewer responses than I expected to 
that thread, but I do think there was a concensus in at least the 
several that did respond.  It's my opinion that most thought the 
ability to "fix" was already present, so don't throw money at 
it - make it easier and less expensive by presently available 
methods.  Perhaps the point escaped me though, so ... dunno.

>
> That said, the Forum structure was just changed today,
> per user request.  The "How to....." Forum has some
> postings in it to start the ball rolling ... as said before
> and elsewhere, it may not be the best solution, but
> there are a number of us actually trying to offer an
> alternative ....
==>  I plan to read those today - but, being on the "forum", 
well, it seems appropriate to the "forum".  Not necessarily the 
newsgroups.  If it is, why not at least a link here, preferably 
an announcement to all, that it's there and it's applicable?

>
> As far as "you've been blocked" ... Miss Betsy's entry
> (both as a Pinned item and a Forum FAQ entry) sure
> covers a lot of ground ....

I will likely agree with that; I can say that much before I even 
get there <g>.

Pop



From nobody at devnull.spamcop.net  Sun Jan 23 15:38:54 2005
From: nobody at devnull.spamcop.net (Heidi)
Date: Sun Jan 23 15:50:02 2005
Subject: [SC-Help] WHY????
Message-ID: <ct12ds$oh3$1@news.spamcop.net>

WHY am I such a cunt? Because its my motherfucking personality. I am not 
a sweet girl and never have been. There is no WHY.

From agent01413 at my-deja.com  Mon Jan 24 07:51:40 2005
From: agent01413 at my-deja.com (Socks)
Date: Mon Jan 24 02:55:04 2005
Subject: [SC-Help] Re: Spamcop is really annoying!
References: <1106413294.280150.286500@c13g2000cwb.googlegroups.com>
Message-ID: <Xns95E88B8BBE99agent01413MYDEJACOM@216.154.195.61>

anteperkovic@vip.hr wrote in news:1106413294.280150.286500
@c13g2000cwb.googlegroups.com:
> 
> Recipient: <CENSORED.CENSORED@CENSORED.com>
> Reason:    5.3.0 <CENSORED.CENSORED@CENSORED.com>... Email from
> 212.91.98.72 rejected - see
> http://www.spamcop.net/w3m?action=checkblock&ip=212.91.98.72>
> 

> ...
> This is really annoying and it heppaned 2 times in 3 days. What are
> they trying to do? 
> 
> Make all the people stop using email?

no. they are trying to get vipnet.hr to stop sending spam to spamcop 
customers.  if vipnet terminates spammers, the system works. if vipnet 
doesnt terminate the spammers, but it is unable to deliver mail to spamcop 
customers, it still works.  From the looks of things, it's working.
From geoff at nospam.gjctech.co.uk  Mon Jan 24 22:10:09 2005
From: geoff at nospam.gjctech.co.uk (Geoff Lane)
Date: Mon Jan 24 17:15:17 2005
Subject: [SC-Help] Wrongly accused
Message-ID: <Xns95E8E243CF17Agjctcswxnsrt@216.154.195.61>

I've been wrongly accused of spamming by another Spamcop user. Although 
most of the problem was due to my ISP (PlusNet) not acting reasonably and 
professionally, the whole thing was started by a Spamcop user reporting 
as spam a post that I made to a mailing list to which he had explicitly 
subscribed. I'm relating this tale here to urge fellow users to take care 
when making those spam reports because I was an innocent party, yet this 
incident closed down my business for just over twenty-four hours.

A few days ago, I receive a LART from my ISP claiming that "my account 
was linked to the source of unsolicited mail." They gave no samples and 
no idea of the quantity of spam. I knew that I hadn't been spamming and 
so knew that any spam must be due to a security breach. I checked my 
firewall to ensure that the incoming SMTP block was still up, then ran 
basic AV checks to find nothing. I phoned my ISP to ask for samples 
(which the didn't provide for over 24 hours). There were adamant that 
there was unsolicited email and it was coming from my system.

To cut a long story short, the balance of probability was that some 
malware was running rampant on my system and I couldn't risk 
contaminating my clients' network until the issue was resolved, which 
meant that I had to shut down my business.

When I got my hands on the promised spam samples, it was just one message 
that the TBUDL listserver had sent to the list. Here's the headers from 
the "offending message"

------------------8<-------------------------
Return-Path: <SRS0=d/DV=P7=thebat.dutaint.com=tbudlbounces@
bounce2.pobox.com> 
Delivered-To: spamcop-net-x 
Received: (qmail 32254 invoked from network); 16 Jan 2005 11:03:10 -0000 
Received: from unknown (HELO c60.cesmail.net) (192.168.1.105) 
by blade2.cesmail.net with SMTP; 16 Jan 2005 11:03:10 -0000 
Received: from mailgate.cesmail.net (216.154.195.36) 
by c60.cesmail.net with SMTP; 16 Jan 2005 06:02:56 -0500 
X-IronPort-AV: i="3.88,128,1102309200"; 
d="scan'208"; a="165434354:sNHT40083828" 
Received: (qmail 14755 invoked from network); 16 Jan 2005 11:02:56 -0000 
Received: from unknown (HELO mailgate.cesmail.net) (192.168.1.101) 
by mailgate.cesmail.net with SMTP; 16 Jan 2005 11:02:56 -0000 
Received: from pop.central.cox.net [68.1.17.2] 
by mailgate.cesmail.net with POP3 (fetchmail-6.2.1) 
for x (single-drop); Sun, 16 Jan 2005 06:02:56 -0500 (EST) 
Received: from fed1rmgxi14.cox.net ([207.8.226.2]) by 
fed1rmmtai14.cox.net 
(InterMail vM.6.01.04.00 201-2131-117-20041022) with ESMTP 
id 
<20050116105825.ZHNK15125.fed1rmmtai14.cox.net@fed1rmgxi14.cox.net> 
for <x>; Sun, 16 Jan 2005 05:58:25 -0500 
Received: from kelvin.pobox.com ([207.8.226.2]) by fed1rmgxi14.cox.net 
(InterMail vG.1.00.00.00 201-2136-104-20040331) with ESMTP 
id <20050116105824.XYNQ4961.fed1rmgxi14.cox.net@kelvin.pobox.com> 
for <x>; Sun, 16 Jan 2005 05:58:24 -0500 
Received: from kelvin.pobox.com (localhost [127.0.0.1]) 
by kelvin.pobox.com (Postfix) with ESMTP id 8E1831E48BF 
for <x>; Sun, 16 Jan 2005 05:58:22 -0500 (EST) 
Delivered-To: x 
Received: from thrall.its-toasted.org (thrall.its-toasted.org 
[62.80.28.11]) 
22/01/2005
PlusNet - Broadband for Home and Business 
http://portal.plus.net/my.html?action=tickets 
Page 4 of 9 
by kelvin.pobox.com (Postfix) with ESMTP id 61EDD1E479F 
for <x>; Sun, 16 Jan 2005 05:58:22 -0500 (EST) 
Received: from draenor.its-toasted.org ([62.80.28.8] ident=list) 
by thrall.its-toasted.org with esmtp (Exim 4.42) 
id 1Cq83Y-0008KR-9F; Sun, 16 Jan 2005 11:54:52 +0100 
Received: from ptb-relay01.plus.net ([212.159.14.212]) 
by draenor.its-toasted.org with esmtp 
(TLS-1.0:DHE_RSA_3DES_EDE_CBC_SHA:24) (Exim 4.33) id 1Cq83V- 
00038G-1E 
for x; Sun, 16 Jan 2005 11:54:49 +0100 
Received: from [80.229.38.243] (helo=colossus) 
by ptb-relay01.plus.net with esmtp (Exim) id 1Cq7lZ-000Jge-2j 
for x; Sun, 16 Jan 2005 10:36:17 +0000 
Received: from 192.168.42.102 by colossus ([192.168.42.104] running 
VPOP3) 
with ESMTP for <x>; 
Sun, 16 Jan 2005 10:31:52 -0000 
Date: Sun, 16 Jan 2005 10:31:51 +0000 
From: Geoff Lane <geoff@gjctech.co.uk> 
X-Mailer: The Bat! (v1.62i) Business 
Organization: GJC Technical Ltd 
X-Priority: 3 (Normal) 
Message-ID: <1167___________________3151@gjctech.co.uk> 
To: TBUDL <x> 
MIME-Version: 1.0 
Content-Type: text/plain; charset=us-ascii 
Content-Transfer-Encoding: 7bit 
X-Server: VPOP3 V1.5.0i - Registered 
X-Greylisted-at: draenor.its-toasted.org 
Cc: 
Subject: Version compatibility 
X-BeenThere: tbudl@thebat.dutaint.com 
X-Mailman-Version: 2.1.5 
Precedence: list 
Reply-To: tbudl@thebat.dutaint.com 
List-Id: tbudl.thebat.dutaint.com 
List-Unsubscribe: <http://stromgrade.itstoasted.
org/mailman/listinfo/tbudl>;, 
<mailto:tbudl-request@thebat.dutaint.com?subject=unsubscribe> 
List-Post: <mailto:tbudl@thebat.dutaint.com> 
List-Help: <mailto:tbudl-request@thebat.dutaint.com?subject=help> 
List-Subscribe: <http://stromgrade.itstoasted.
org/mailman/listinfo/tbudl>;, 
<mailto:tbudl-request@thebat.dutaint.com?subject=subscribe> 
Sender: tbudl-bounces@thebat.dutaint.com 
Errors-To: tbudl-bounces@thebat.dutaint.com 
X-Spam-Checker-Version: SpamAssassin 3.0.0 (2004-09-13) on 
blade2.cesmail.net 
X-Spam-Level: 
X-Spam-Status: hits=0.1 tests=FORGED_RCVD_HELO version=3.0.0 
X-SpamCop-Checked: 192.168.1.105 216.154.195.36 192.168.1.101 
22/01/2005
Page 5 of 9 PlusNet - Broadband for Home and Business 
68.1.17.2 207.8.226.2 6.1.4.0 207.8.226.2 1.0.0.0 127.0.0.1 62.80.28.11 
62.80.28.8 212.159.14.212 80.229.38.243 192.168.42.102 192.1 
------------------8<------------------------

During the "conversation" with my ISP, it transpired that they haven't 
got the resources to check every Spamcop complaint and send a LART in 
response to every Spamcop report, even if their customer is innocent.

So, how do I sent a LART back to the pill*ck who sent that report, caused 
me substatial grief, and deprived me of a day's income?

TIA,

-- 
Geoff Lane
Cornwall, UK
From MikeE at ster.invalid  Mon Jan 24 16:04:07 2005
From: MikeE at ster.invalid (Mike Easter)
Date: Mon Jan 24 19:05:06 2005
Subject: [SC-Help] Re: Wrongly accused
References: <Xns95E8E243CF17Agjctcswxnsrt@216.154.195.61>
Message-ID: <ct42do$q44$1@news.spamcop.net>

Geoff Lane wrote:
> I've been wrongly accused of spamming by another Spamcop user.
> Although most of the problem was due to my ISP (PlusNet) not acting
> reasonably and professionally, the whole thing was started by a
> Spamcop user reporting as spam a post that I made to a mailing list
> to which he had explicitly subscribed. I'm relating this tale here to
> urge fellow users to take care when making those spam reports because
> I was an innocent party, yet this incident closed down my business
> for just over twenty-four hours.

Mailing list problems are supposed to be worked out in/thru' the mailing
list, not SC reported.

http://www.spamcop.net/fom-serve/cache/14.html - On what type of email
should I (not) use SpamCop? -
 "Spam sent to mail lists/groups must not be reported using SpamCop
except by the list owner. Subscribers may send a note to the list owner
who can block the source from sending to the list or take responsibility
for reporting the spam themselves."

> A few days ago, I receive a LART from my ISP claiming that "my account
> was linked to the source of unsolicited mail." They gave no samples
> and no idea of the quantity of spam. I knew that I hadn't been
> spamming and so knew that any spam must be due to a security breach.
> I checked my firewall to ensure that the incoming SMTP block was
> still up, then ran basic AV checks to find nothing. I phoned my ISP
> to ask for samples (which the didn't provide for over 24 hours).
> There were adamant that there was unsolicited email and it was coming
> from my system.

Your provider is supposed to look at a reported item and make some
intelligent appropriate judgment about it.

> To cut a long story short, the balance of probability was that some
> malware was running rampant on my system and I couldn't risk
> contaminating my clients' network until the issue was resolved, which
> meant that I had to shut down my business.

That sounds pretty weird to me.

> When I got my hands on the promised spam samples, it was just one
> message that the TBUDL listserver had sent to the list. Here's the
> headers from the "offending message"

What is TBUDL?  Those are sure a lot of trace lines, what is the point
of the headers?

  from (HELO c60.cesmail.net) (192.168.1.105) by blade2.cesmail.net
  from mailgate.cesmail.net (216.154.195.36) by c60.cesmail.net
  from (HELO mailgate.cesmail.net) (192.168.1.101) by
mailgate.cesmail.net
  from pop.central.cox.net [68.1.17.2] by mailgate.cesmail.net
  from fed1rmgxi14.cox.net ([207.8.226.2]) by fed1rmmtai14.cox.net
  from kelvin.pobox.com ([207.8.226.2]) by fed1rmgxi14.cox.net
  from kelvin.pobox.com by kelvin.pobox.com
  from (thrall.its-toasted.org [62.80.28.11]) by kelvin.pobox.com
  from draenor.its-toasted.org ([62.80.28.8] ident=list)  by
thrall.its-toasted.org
  from ptb-relay01.plus.net ([212.159.14.212]) by
draenor.its-toasted.org
  from [80.229.38.243] (helo=colossus) by ptb-relay01.plus.net

or, more briefly:  gjctech.plus.com => pobox.com => cox => SC

> During the "conversation" with my ISP, it transpired that they haven't
> got the resources to check every Spamcop complaint and send a LART in
> response to every Spamcop report, even if their customer is innocent.

So the provider strategy is that they don't look at the report but they
tell you that you are spamming;  and then your response to that is to
shut down.

It seems to me that nobody is doing anything right;  the reporter, the
provider/notified, or you.

> So, how do I sent a LART back to the pill*ck who sent that report,
> caused me substatial grief, and deprived me of a day's income?

When a reporter does wrong, s/he can be disciplined.

-- 
Mike Easter
kibitzer, not SC admin

From geoff at nospam.gjctech.co.uk  Tue Jan 25 01:12:59 2005
From: geoff at nospam.gjctech.co.uk (Geoff Lane)
Date: Mon Jan 24 20:15:10 2005
Subject: [SC-Help] Re: Wrongly accused
References: <Xns95E8E243CF17Agjctcswxnsrt@216.154.195.61>
	<ct42do$q44$1@news.spamcop.net>
Message-ID: <Xns95E9D1F415E7gjctcswxnsrt@216.154.195.61>

"Mike Easter" <MikeE@ster.invalid> wrote in
news:ct42do$q44$1@news.spamcop.net: 

> 
> Mailing list problems are supposed to be worked out in/thru' the
> mailing list, not SC reported.
---
Absolutely, which is one count on which the person who made the report
broke SC's rules. 
 
> Your provider is supposed to look at a reported item and make some
> intelligent appropriate judgment about it.
---
Yes, and they tell me they don't have the resources to look at the 
plethora of items that Spamcop sends. To do that would make them 
uncompetitive and possibly put them out of business.

That said, I've taken them to task about it. They refuse to believe that
they've done wrong but will consider rewording their LARTs so that they
at least tell the truth. They had no verified evidence of spam, yet they
didn't say there was a complaint, they said there was spam and it was
coming from my system.

>> To cut a long story short, the balance of probability was that some
>> malware was running rampant on my system and I couldn't risk
>> contaminating my clients' network until the issue was resolved, which
>> meant that I had to shut down my business.
> 
> That sounds pretty weird to me.
---
Put simply, I couldn't find a problem. I knew that I personally hadn't 
sent any spam. However, my ISP were adamant that the spam existed and 
they claimed to have irrefutable evidence that it was coming from me. 
Just because I couldn't identify the problem doesn't meant it didn't 
exist. I'm currently working on a client's project via a VPN tunnel, 
which means that my network is connected to theirs, which means that the 
machine hosting the tunnel could provide a conduit for some malware to 
propogate to my client's network, which is something I couldn't risk. 
Realistically, I had no choice but close the VPN tunnel, which 
effectively shut down my business until the matter was resolved. 

> 
> It seems to me that nobody is doing anything right;  the reporter, the
> provider/notified, or you.
---
The general consensus on my ISP's support forum was that I'd acted
reasonably. However, the reporter violated SC's rules on two counts, and
my ISP falsely claimed as fact something they did not know to be true,
and their AUP notice was not as helpful as it should have been. 

Until this incident, I wouldn't have believed that an ISP would threaten
to suspend a user's account on the basis of one unverified complaint.
Not only that, their LART was sent by a robot! However, I wasn't to know
that my ISP was using a robot and misrepresenting the facts and assumed
that an abuse-desk bod had received shedloads of reports from all over
the place. The only way that I feel I could have acted differently would
have been to ignore my ISP's LART which, had my assumptions been
correct, would probably have been the most irresponsible act I could
have done. Is that what you're suggesting I should have done? 

With hindsight, I can see the scenario now:
SC user's spam filter dumps my legitimate post into his spam bin, which
is set up to forward automatically to SC's reporting service. He gets a
confirmation message from SC with a link to click to open the report in
his browser (at least, I hope that SC still works that way). However,
the user has tens of SC confirmation messages waiting his attention, and
so he sends reports for them all without checking that they actually are
spam. 

> 
>> So, how do I sent a LART back to the pill*ck who sent that report,
>> caused me substatial grief, and deprived me of a day's income?
> 
> When a reporter does wrong, s/he can be disciplined.
> 
But how? The reporter has violated Spamcop's rules on at least two
counts:
1. He's reported a message from a mailing list.
2. The message he reported was not spam; it was an on-topic post to that
   mailing list.
However, I can't find anything in SC Help that tells me how to complain.

Spamcop is a double-edged sword. Although it helps in the fight against 
spam, that comes at a price. The more innocent parties that get hurt, the 
less people will be inclined to trust Spamcop. Just like spam filters, 
too many false positives makes Spamcop of questionable value and one way 
of reducing those false positives is to take action against those who 
falsely accuse.

So, once again, how do I report this reporter?

-- 
Geoff Lane
Cornwall, UK
From nobody at devnull.spamcop.net  Mon Jan 24 20:53:55 2005
From: nobody at devnull.spamcop.net (WazoO)
Date: Mon Jan 24 21:55:03 2005
Subject: [SC-Help] Re: Wrongly accused
References: <Xns95E8E243CF17Agjctcswxnsrt@216.154.195.61>
	<ct42do$q44$1@news.spamcop.net> <Xns95E9D1F415E7gjctcswxnsrt@216.154.195.61>
Message-ID: <ct4cc4$20n$1@news.spamcop.net>

"Geoff Lane" <geoff@nospam.gjctech.co.uk> wrote in message
news:Xns95E9D1F415E7gjctcswxnsrt@216.154.195.61...
> >
> >> So, how do I sent a LART back to the pill*ck who sent that report,
> >> caused me substatial grief, and deprived me of a day's income?
> >
> > When a reporter does wrong, s/he can be disciplined.
> >
> But how? The reporter has violated Spamcop's rules on at least two
> counts:
> 1. He's reported a message from a mailing list.
> 2. The message he reported was not spam; it was an on-topic post to that
>    mailing list.
> However, I can't find anything in SC Help that tells me how to complain.
>
<snip>
> So, once again, how do I report this reporter?

As you can't seem to find it on the www.spamcop.net FAQ, you
could try the Forum FAQ, much expanded ...
http://forum.spamcop.net/forums/index.php?showtopic=2238


From driehuis.fcnzpbc2005 at playbeing.com  Tue Jan 25 04:59:06 2005
From: driehuis.fcnzpbc2005 at playbeing.com (Bert Driehuis)
Date: Mon Jan 24 23:00:03 2005
Subject: [SC-Help] Re: Paul Hwang is out of the office.
In-Reply-To: <csssnm$9e0$1@news.spamcop.net>
References: <mailman.68.1106326937.4572.spamcop-help@news.spamcop.net>
	<csrg52$c83$1@news.spamcop.net> <Xns95E5D25E427D6blammo@216.154.195.61>
	<csssnm$9e0$1@news.spamcop.net>
Message-ID: <ct4g6c$5vl$1@news.spamcop.net>

John E. Malmberg wrote:

> A U.S. TV news show some years back demonstrated to the horror of the 
> company executive that authorized the test how easy it was to get his 
> help desk to give the private investigator everything that he needed to 
> dial and log into an executive level account on their computer.  The 
> executive thought that the test would be a technological attack, not 
> just calling and asking to be let in.

You wouldn't happen to know which TV show? For reasons unbeknownst to 
me, managers seem to take advice more easily from a talking head than 
from a newsgroup.
From nobody at devnull.spamcop.net  Mon Jan 24 23:17:03 2005
From: nobody at devnull.spamcop.net (Cat)
Date: Tue Jan 25 00:20:03 2005
Subject: [SC-Help] Re: Wrongly accused
In-Reply-To: <Xns95E9D1F415E7gjctcswxnsrt@216.154.195.61>
References: <Xns95E8E243CF17Agjctcswxnsrt@216.154.195.61>
	<ct42do$q44$1@news.spamcop.net> <Xns95E9D1F415E7gjctcswxnsrt@216.154.195.61>
Message-ID: <ct4ko6$9tk$1@news.spamcop.net>

Geoff Lane wrote:

<snip>

> Yes, and they tell me they don't have the resources to look at the 
> plethora of items that Spamcop sends. To do that would make them 
> uncompetitive and possibly put them out of business.

<snip>

If they can't handle the amount of SpamCop complaints they receive, then 
it sounds like they have a bigger problem that they aren't bothering to 
take care of. Ignoring spam issues or mistakenly suspending innocent 
people is more of a danger of putting them out of business. I once had 
an incident where I received spam from a hotel chain where I had made 
sure that I did not check the box agreeing to be added to their mailing 
list when I made my reservation (which I had to cancel before the spam 
started due to rescheduling the trip and ended up making a reservation 
at a different non-spamming hotel chain). They ignored my preferences 
and added me to their mailing list anyway. The ISP of their mailing list 
manager wrote to me with something along the lines that his clients were 
all respected major businesses and would never send spam, so I replied 
asking him why I was spammed if what he said was true. He claimed the 
usual excuses that I must have forgotten and other equally silly 
excuses, but I pointed out that I most definitely left the box unchecked 
  so that I wouldn't be added to the mailing list. He replied saying 
that he couldn't afford to have his servers labeled as spam. I wrote 
back that if other ISPs were blocking his servers as a spam source, he 
had only himself to blame for allowing his clients to send spam without 
punishment. The spam (and the ISP's excuses) stopped after that.

Anyway, my story above is just to point out that if your ISP would act 
on complaints without proof that you're innocent because they claim they 
can't keep up with the volume of complaints, they appear to have a much 
bigger spam problem that they're ignoring and are just wacking every 
customer who gets a complaint without caring whether that customer might 
be an innocent victim of false complaints. Your ISP is behaving 
irresponsibly and trying to put the blame on someone else.
From geoff at nospam.gjctech.co.uk  Tue Jan 25 08:44:58 2005
From: geoff at nospam.gjctech.co.uk (Geoff Lane)
Date: Tue Jan 25 03:45:04 2005
Subject: [SC-Help] Re: Wrongly accused
References: <Xns95E8E243CF17Agjctcswxnsrt@216.154.195.61>
	<ct42do$q44$1@news.spamcop.net> <Xns95E9D1F415E7gjctcswxnsrt@216.154.195.61>
	<ct4cc4$20n$1@news.spamcop.net>
Message-ID: <Xns95E959C0EB232gjctcswxnsrt@216.154.195.61>

"WazoO" <nobody@devnull.spamcop.net> wrote in news:ct4cc4$20n$1
@news.spamcop.net:

>> So, once again, how do I report this reporter?
> 
> As you can't seem to find it on the www.spamcop.net FAQ, you
> could try the Forum FAQ, much expanded ...
> http://forum.spamcop.net/forums/index.php?showtopic=2238

Thanks for the link. I'd already spent a lot of time working my way 
through the FAQ and seeing them flattened like that help me confirm that 
the facility I want just isn't there. About the closest that I found were 
"I have been falsely and/or maliciously accused of spamming, what can I 
do?", and "How do I get in touch with the person who filed the 
complaint?"

"I have been falsely and/or maliciously accused of spamming, what can I 
do?" tells me that, "Users who file false reports will be banned from the 
SpamCop service and/or fined"; it tells me how to appeal against being 
blacklisted. It does not offer me a way to actually report the user.

"How do I get in touch with the person who filed the complaint?" tells me 
to reply to the report to contact the reporter. However, the report 
wasn't sent to me; it was sent to my ISP and I don't have the report 
email - I have the text that my ISP copied into their "Contact Us" 
facility. That said, I don't want to contact the reporter -- I want to 
report him for his breach of Spamcop's rules.

So, Spamcop claims that users who file false reports will be punished, 
but I'll bet that Spamcop doesn't get that many complaints about false 
reports because there isn't an easily visible way to make those 
complaints.

-- 
Geoff Lane
Cornwall, UK
From gospamming at yourdomain.invalid  Tue Jan 25 08:55:44 2005
From: gospamming at yourdomain.invalid (D.Diaz)
Date: Tue Jan 25 04:00:03 2005
Subject: [SC-Help] Re: Wrongly accused
References: <Xns95E8E243CF17Agjctcswxnsrt@216.154.195.61>
	<ct42do$q44$1@news.spamcop.net> <Xns95E9D1F415E7gjctcswxnsrt@216.154.195.61>
	<ct4cc4$20n$1@news.spamcop.net> <Xns95E959C0EB232gjctcswxnsrt@216.154.195.61>
Message-ID: <Xns95E965006D7E7xnddmxn@216.154.195.61>

Geoff Lane <geoff@nospam.gjctech.co.uk> wrote in
news:Xns95E959C0EB232gjctcswxnsrt@216.154.195.61: 

> So, Spamcop claims that users who file false reports will be punished,
> but I'll bet that Spamcop doesn't get that many complaints about false
> reports because there isn't an easily visible way to make those 
> complaints.
> 

If you do have an actual copy of the SpamCop Report filed against you,
the simplest course of action I can think of would be writing to
deputies [at] admin.spamcop.net explaining this issue and citing the
report ID (the long number in the From: or Reply To: headers of the
SpamCop Report). Including a copy of the offending SpamCop Report would
also be useful too, I think. 

-- 
Daniel Diaz
SpamCop User
From geoff at nospam.gjctech.co.uk  Tue Jan 25 09:27:23 2005
From: geoff at nospam.gjctech.co.uk (Geoff Lane)
Date: Tue Jan 25 04:30:06 2005
Subject: [SC-Help] Re: Wrongly accused
References: <Xns95E8E243CF17Agjctcswxnsrt@216.154.195.61>
	<ct42do$q44$1@news.spamcop.net> <Xns95E9D1F415E7gjctcswxnsrt@216.154.195.61>
	<ct4cc4$20n$1@news.spamcop.net> <Xns95E959C0EB232gjctcswxnsrt@216.154.195.61>
	<Xns95E965006D7E7xnddmxn@216.154.195.61>
Message-ID: <Xns95E960F237760gjctcswxnsrt@216.154.195.61>

"D.Diaz" <gospamming@yourdomain.invalid> wrote in 
news:Xns95E965006D7E7xnddmxn@216.154.195.61:

> If you do have an actual copy of the SpamCop Report filed against you,
> the simplest course of action I can think of would be writing to
> deputies [at] admin.spamcop.net explaining this issue and citing the
> report ID (the long number in the From: or Reply To: headers of the
> SpamCop Report). Including a copy of the offending SpamCop Report would
> also be useful too, I think. 

Thanks. Unfortunately, I don't have the report, just the "offending 
message" that my ISP provided, which I suspect they cut-and-pasted from the 
Spamcop report. What I have doesn't include the report ID and, because the 
matter is sub judice, I am not at liberty to request the full report from 
them.

That said, I've just found a means of filing a complaint. At the bottom of 
http://www.spamcop.net/fom-serve/cache/401.html is a small form to contact 
Spamcop for "other reasons". I've used that to make my complaint. However, 
relegating complaints about false accusations to "other reasons" doesn't 
give me any assurance about the quality of Spamcop's service!

-- 
Geoff Lane
Cornwall, UK
From geoff at nospam.gjctech.co.uk  Tue Jan 25 13:05:57 2005
From: geoff at nospam.gjctech.co.uk (Geoff Lane)
Date: Tue Jan 25 08:10:03 2005
Subject: [SC-Help] Re: Wrongly accused
References: <Xns95E8E243CF17Agjctcswxnsrt@216.154.195.61>
	<ct42do$q44$1@news.spamcop.net> <Xns95E9D1F415E7gjctcswxnsrt@216.154.195.61>
	<ct4ko6$9tk$1@news.spamcop.net>
Message-ID: <Xns95E986003207gjctcswxnsrt@216.154.195.61>

Cat <nobody@devnull.spamcop.net> wrote in news:ct4ko6$9tk$1
@news.spamcop.net:

> Your ISP is behaving 
> irresponsibly and trying to put the blame on someone else.
> 

Behaving irresponsibly? Perhaps. Not meeting their obligations to their 
customers? Probably. However, I don't believe they are trying to put the 
blame on someone else. They are stating a fact of their business: they 
don't have the resources to read every complaint they get from Spamcop.

Right now all their CGI servers are blacklisted (I suspect with good 
reason). I've seen some claims that I find disturbing on that subject. 
For an example, see http://tinyurl.com/3sw24 (.) So PlusNet do have a 
much bigger spam problem, as you suggest. However, they are doing 
something about the CGI servers and have scheduled downtime for fully 
rebuilding them.

That said, last night Spamcop had at least one of those CGI servers 
blacklisted with a claim that it would be delisted in zero hours -- and 
that claim was there for three hours. Now a claim that a host will be 
delisted in zero hours can legitimately be valid for a maximum of one 
hour, so Spamcop also has problems and cannot automatically be assumed 
blameless.

WRT the concept of behaving irresponsibly, what makes you think that 
Spamcop has any less responsibility for ensuring that it's reports are 
accurate than does the ISP? An unwarranted inclusion in the Spamcop BL is 
far more serious and potentially far more damaging than a single report 
inappropriately acted upon by one ISP. As I've discovered, someone with 
malintent (or even someone who is mistaken) can easily use Spamcop as a 
means to damage a victim. Spamcop does not even provide easy means for 
the victim to highlight the injustice, and I suspect would not take 
speedy action if it did.

Spamcop's help for abuse desks states that they don't have the resources 
to verify each report. What makes you think that an ISP should be any 
different? That an ISP should be forced to finance additional people to 
counter errors or even malintent from Spamcop and its users? If Spamcop 
actually had credible quality control, those ISP resources would not be 
necessary, and so it is Spamcop's lack of quality control that is costing 
ISPs and their customers dearly.

-- 
Geoff Lane
Cornwall, UK
From nobody at devnull.spamcop.net  Tue Jan 25 09:44:58 2005
From: nobody at devnull.spamcop.net (Pop)
Date: Tue Jan 25 09:45:06 2005
Subject: [SC-Help] Re: Wrongly accused
References: <Xns95E8E243CF17Agjctcswxnsrt@216.154.195.61>
	<ct42do$q44$1@news.spamcop.net> <Xns95E9D1F415E7gjctcswxnsrt@216.154.195.61>
	<ct4ko6$9tk$1@news.spamcop.net> <Xns95E986003207gjctcswxnsrt@216.154.195.61>
Message-ID: <ct5m13$vn4$1@news.spamcop.net>

>From the Peanut Gallery (top + inline + bottom posted):

I"ve read this thread and IMO, some basics have been missed:

The basic question:  "How do I file a complaint against a SC 
user" has been ignored.  Yes, I know the answer was "implied" in 
a couple of places, and "alluded to" peripherally.  But to a 
stranger in this land, the answer was never given.  And yes, I 
can see that the ISP is dirty as bull feces in hell's bowels, but 
... still, a question was asked and evaded.
   How -does- one address a complaint about a SC user?  It need 
not be "public", but the question should have been addressed 
privately, publicly, whatever might be appropriate.  I think I'd 
suggest private contacts, but yes, I also do see abuse of that 
very system of abuse prevention.

...
>  ...  They are stating a fact of their business: they
> don't have the resources to read every complaint they get from 
> Spamcop.

==>  Believable.  IMO, that's good, albeit probably only a 
partial descrip of the situ.   "It's policy" is the main retort 
of entirely too many businesses.  I'd be pretty seriously looking 
for another ISP to run parallel for awhile until I could dispense 
those louts.  I realize how not-doable that might be, but it's 
what I myself would do.
   Can you take them to task about not enforcing their AUP or 
TOS?   Have you talked to anyone beyond their first-line support?
>
> Right now all their CGI servers are blacklisted (I suspect with 
> good
> reason). I've seen some claims that I find disturbing on that 
> subject.
> For an example, see http://tinyurl.com/3sw24 (.) So PlusNet do 
> have a
> much bigger spam problem, as you suggest. However, they are 
> doing
> something about the CGI servers and have scheduled downtime for 
> fully
> rebuilding them.
==>  This might be the reason for their knee-jerk reaction to 
your situation and if so, they need to change, IMO, but never 
will unless they come to understand their mistakes.  Even a 
complete newbie should understand that ONE spam report against a 
person is not valid without proof.  Have they actually stated 
that is the ONLY spam report on you?

>
> That said, last night Spamcop had at least one of those CGI 
> servers
> blacklisted with a claim that it would be delisted in zero 
> hours -- and
> that claim was there for three hours. Now a claim that a host 
> will be
> delisted in zero hours can legitimately be valid for a maximum 
> of one
> hour, so Spamcop also has problems and cannot automatically be 
> assumed
> blameless.
==>  Someone better will come along and comment on that, I'm sure 
but the delist time depends on -history- and if further reports 
were received, eg when the future becomes the past, the delist 
time would change.  So a delisting time could go from minimum to 
mazimum in a very short period of time.  I don't even pretend to 
understand the SC algorithms but they are pretty good.

>
> WRT the concept of behaving irresponsibly, what makes you think 
> that
> Spamcop has any less responsibility for ensuring that it's 
> reports are
> accurate than does the ISP? An unwarranted inclusion in the 
> Spamcop BL is
> far more serious and potentially far more damaging than a 
> single report
...
==>  I quite strongly disagree.  The SC b/l is a pretty gentle 
listing compared to many, which can take months or years to 
delist a site.  SC is really nothing but a lookup service which 
automates the use of several tracing and tracking engines.  It's 
the reporter's responsibility to see that reports go to the right 
place.  And that leads back to the lack of a specific answer to 
your question about how to file the complaint.
   It is your ISP who acted ignorantly, maliciously and possibly 
via knee-jerk responses against you.  From the sound of 
everything, this ISP isn't the most experienced in the world and 
did react to spam:  Too harshly and without heeding any 
recommendations, apparently because no reputable source would 
recommend dropping a site based on one complaint.  It's just 
plain ignorance, IMO.
   There also is the question of WHY you were reported to SC, but 
that's a backburner thing at this point.    Perhaps you should do 
a re-confirmation of people on any lists you use to send mails. 
Drop those that don't re-confirm or are old addresses.  Assuming 
you have confirmed opt ins, that is.


> Spamcop's help for abuse desks states that they don't have the 
> resources
> to verify each report. What makes you think that an ISP should 
> be any
> different?
==>  IMO, because the reporter and many others might be 
VOLUNTEERS and SC clearly recommends AGAINST using its lists for 
the purpose used against you.  If your ISP is using the sbl, then 
they should have read the how-to's , or at least asked on the 
groups.  Again, it looks like a knee-jerk.  Any chance of getting 
into your ISP's good graces and working -with- him in the 
education process?  Or has that progressed to serious animosity?

That an ISP should be forced to finance additional people to
> counter errors or even malintent from Spamcop and its users?
==>  Not so.  No one forced the ISP to setup so that spamming 
could occur.  This is the ISP's fault, and those people wouldn't 
be needed had the configurations been correct.  By attacking a 
spam problem after the fact is re-active.  Most good ISPs are 
pro-active, at least in the ares of spam control because they 
KNOW spam is going to cost them money in bandwidth, people, and 
time lost as in their present shutdown of the server.  Just 
owning a big computer or fifty does not make one capable of being 
a good ISP.  ISPs have to think, not just sit back and hope the 
money rolls in.


> If Spamcop
> actually had credible quality control, those ISP resources 
> would not be
> necessary, and so it is Spamcop's lack of quality control that 
> is costing
> ISPs and their customers dearly.
==>  IMO, as one who has been in management most of my working 
life, SC's QC, especially considering it's history of coming into 
being, is well above the average.  Too much QC can lead to 
choking an outfit's efforts and easily make it ineffective.  It's 
certainly 99.999% better than almost any of the ISPs complaints 
come in on.

Yes, you have a problem.  Yes, I think your questions should have 
been more directly answered.  No, I'm not connected to SC except 
as a constant user.  Yes, I have a lot of issues about SC, but 
integrity isn't one of them.  For now I accept the shortcomings 
as I find this very unique and reliable service to be of value to 
me and I believe I contribute to its value on occasion.  Value # 
money here; I mean intrinsic value.

I'm hoping someone, maybe a deputy, will either look into this 
situation and respond accordingly.  I think I deputy has in fact 
responded to you, but not as a deputy.   They don't seem to 
announce themselves as such, because there are different levels I 
think, so I won't name him.

Regards,

Pop

From geoff at nospam.gjctech.co.uk  Tue Jan 25 17:23:01 2005
From: geoff at nospam.gjctech.co.uk (Geoff Lane)
Date: Tue Jan 25 12:25:03 2005
Subject: [SC-Help] Re: Wrongly accused
References: <Xns95E8E243CF17Agjctcswxnsrt@216.154.195.61>
	<ct42do$q44$1@news.spamcop.net> <Xns95E9D1F415E7gjctcswxnsrt@216.154.195.61>
	<ct4ko6$9tk$1@news.spamcop.net> <Xns95E986003207gjctcswxnsrt@216.154.195.61>
	<ct5m13$vn4$1@news.spamcop.net>
Message-ID: <Xns95E9B195E77B1gjctcswxnsrt@216.154.195.61>

"Pop" <nobody@devnull.spamcop.net> wrote in news:ct5m13$vn4$1
@news.spamcop.net:

> From the Peanut Gallery (top + inline + bottom posted):

(massive amount of helpful and well thought out stuff snipped)

Thanks. To put the record straight, I used the "other reasons" contact 
stub form to complain about that false report and I already have had a 
satisfactory response. That said, may I suggest that a means of 
complaining about false reports be made explicit and prominent?

Now for the "acting responsibly" bit: When I asked whether Spamcop should 
have any less responsibility for ensuring accuracy of reports than does 
an ISP, It wasn't because of my ISP's massively inappropriate and 
automated reaction, it was because many ISPs use the SBL to as their main 
or only spam filter. Even if they didn't enough people use Spampal et al. 
that does use the SBL. So, some malicious person uses Spamcop to get his 
victim on your blacklist. Now that you have them, let's assume that 
malicious person is a SC mole. So, he gets you blacklisted, your messages 
start bouncing, your business suffers. Spamcop has gone further than 
before and protects its moles, so you can not now even know what you're 
supposed to have done. You can be convicted without trial, sight of the 
evidence against you, and without redress. IMO, that's more than enough 
reason for Spamcop to have an obligation to ensure that its reports are 
accurate.

-- 
Geoff Lane
Cornwall, UK
From gospamming at yourdomain.invalid  Tue Jan 25 17:37:58 2005
From: gospamming at yourdomain.invalid (D.Diaz)
Date: Tue Jan 25 12:40:03 2005
Subject: [SC-Help] Re: Wrongly accused
References: <Xns95E8E243CF17Agjctcswxnsrt@216.154.195.61>
	<ct42do$q44$1@news.spamcop.net> <Xns95E9D1F415E7gjctcswxnsrt@216.154.195.61>
	<ct4ko6$9tk$1@news.spamcop.net> <Xns95E986003207gjctcswxnsrt@216.154.195.61>
	<ct5m13$vn4$1@news.spamcop.net> <Xns95E9B195E77B1gjctcswxnsrt@216.154.195.61>
Message-ID: <Xns95E9BD8AF7780xnddmxn@216.154.195.61>

Geoff Lane <geoff@nospam.gjctech.co.uk> wrote in
news:Xns95E9B195E77B1gjctcswxnsrt@216.154.195.61: 

> Now that you have them, let's assume that 
> malicious person is a SC mole. So, he gets you blacklisted, 

No.  Don't be mistaken:  mole users *do not* send reports and *do not*
contribute to the blocklist.  Mole user data just adds up to the general
statistics.

-- 
Daniel Diaz
SpamCop User
From MikeE at ster.invalid  Tue Jan 25 09:42:08 2005
From: MikeE at ster.invalid (Mike Easter)
Date: Tue Jan 25 12:45:03 2005
Subject: [SC-Help] 
	Re: Failing to track spammer - is this being parsed correctly?
References: <ct452v$s56$1@news.spamcop.net>
Message-ID: <ct60de$8sk$1@news.spamcop.net>

posted to .help & .spam, f/ups to .help

Phil Scadden wrote:
> Tracker is
www.spamcop.net/sc?id=z724762596z5b065452f3ad83623c927332069673ffz

  Abbreviated Received lines *comment
  from grfn6.gns.cri.nz ([131.203.5.60]) by dndm1.gns.cri.nz *serves you
  from omega.gns.cri.nz by grfn6.gns.cri.nz *serves you, ignored
  from (adsl-67-39-200-54.dsl.bcvloh.ameritech.net [67.39.200.54]) by
omega.gns.cri.nz *sourceline

> but it is deciding that the source is forged and declaring our mail
> gateway is the spammer.

That is not currently happening with that parse.  The parse result has
changed.

> Getting a few of these which look to me from inside ameritech space.

The source is now named as the ameritech IP.

If reported today, reports would be sent to:
Re: 67.39.200.54 (Administrator of network where email originates)
abuse@ameritech.net

What was probably happening before was the chain was being broken
prematurely because SC was unfamiliar with the relay and it failed what
I call the 'mx step'.  The evidence of the mx step having 'matured' and
SC recognizing the server by is demonstrated in these 2 sections of the
verbose:

131.203.5.60 is not an MX for dndm1.gns.cri.nz
131.203.5.60 is not an MX for grfn6.gns.cri.nz
131.203.5.60 is not an MX for omega.gns.cri.nz
131.203.5.60 is not an MX for dndm1.gns.cri.nz

   Chain test:omega.gns.cri.nz =? grfn6.gns.cri.nz
   host grfn6.gns.cri.nz (checking ip) = 131.203.5.60
   131.203.5.60 is not an MX for omega.gns.cri.nz
   host omega.gns.cri.nz (checking ip) = 161.65.52.34
   131.203.5.60 is not an MX for omega.gns.cri.nz
   omega.gns.cri.nz and grfn6.gns.cri.nz have same domain - chain
verified
Possible relay: 131.203.5.60
131.203.5.60 not listed in relays.ordb.org.
131.203.5.60 has already been sent to relay testers
Received line accepted

If that line is not accepted, then the chain breaks and SC names the
source 131.203.5.60  rDNS  grfn6.gns.cri.nz

The problem originates because of the discrepancy between or about
mx1.gns.cri.nz vs omega.gns.cri.nz and the IPs 161.65.52.34 and
131.203.5.60  which are nowhere near each other.

The mx is 161.65.52.34 and it rDNSes one way and the DNS is the other.
That is, the mx for gns.cri.nz is 161.65.52.34 which is mx1.gns.cri.nz
or omega.gns.cri.nz  not  131.203.5.60

SC is trying to 'figure that out' and it is just an algorithm.  The 'old
fashioned' remedy was that SC would break the chain and send the
possible relay to the relay testers.  The 'new fangled' remedy is that
people who put their mailhosts into mailhost configuration have the
correct result 'immediately'.


As a housekeeping issue;  the reason I 'moved' my reply and its f/ups
from where you originally posted in .spam is because spamcop.spam is
just supposed to be a place where 'raw' spam is posted [a tracker isn't
raw spam and is better than raw spam] and either of the groups
spamcop.help or spamcop are where things like this are discussed.


-- 
Mike Easter
kibitzer, not SC admin

From MikeE at ster.invalid  Tue Jan 25 09:53:52 2005
From: MikeE at ster.invalid (Mike Easter)
Date: Tue Jan 25 12:55:03 2005
Subject: [SC-Help] Re: Wrongly accused
References: <Xns95E8E243CF17Agjctcswxnsrt@216.154.195.61>
Message-ID: <ct613d$9bi$1@news.spamcop.net>

Geoff Lane wrote:
> A few days ago, I receive a LART from my ISP claiming that "my account
> was linked to the source of unsolicited mail."

> Received: from [80.229.38.243]

> From: Geoff Lane <geoff@gjctech.co.uk>

A SC report about a spam with those headers would've been sent to
abuse@plus.net

The sole job of an abuse desk is to find out what is going on with abuse
reports, especially abuse reports which can have an effect on their
client's ability to send mail successfully.  SpamCop reports can
adversely affect their clients' mail success by causing SCbl listing.

So, the abuse desk must examine the report to determine the veracity of
the spamming incident, because they should be 'squashing' or otherwise
properly managing spamsources from their IPs.  Similarly, if a SC report
is 'false' then they similarly have a responsibility to respond to the
report to the SC administrative process to tell them the report is *NOT*
spam.  SC has a facility for that.

If they handle the spam report improperly they are both stupid /and/
irresponsible in their duty.

You aren't in a very good position to respond to the report because you
didn't get it/ the report.  That is the duty of the desk which received
the report.


-- 
Mike Easter
kibitzer, not SC admin

From geoff at nospam.gjctech.co.uk  Tue Jan 25 18:23:49 2005
From: geoff at nospam.gjctech.co.uk (Geoff Lane)
Date: Tue Jan 25 13:25:04 2005
Subject: [SC-Help] Re: Wrongly accused
References: <Xns95E8E243CF17Agjctcswxnsrt@216.154.195.61>
	<ct42do$q44$1@news.spamcop.net> <Xns95E9D1F415E7gjctcswxnsrt@216.154.195.61>
	<ct4ko6$9tk$1@news.spamcop.net> <Xns95E986003207gjctcswxnsrt@216.154.195.61>
	<ct5m13$vn4$1@news.spamcop.net> <Xns95E9B195E77B1gjctcswxnsrt@216.154.195.61>
	<Xns95E9BD8AF7780xnddmxn@216.154.195.61>
Message-ID: <Xns95E9BBE4CABBFgjctcswxnsrt@216.154.195.61>

"D.Diaz" <gospamming@yourdomain.invalid> wrote in 
news:Xns95E9BD8AF7780xnddmxn@216.154.195.61:

>> Now that you have them, let's assume that 
>> malicious person is a SC mole. So, he gets you blacklisted, 
> 
> No.  Don't be mistaken:  mole users *do not* send reports and *do not*
> contribute to the blocklist.  Mole user data just adds up to the general
> statistics.

Thanks -- it appears I misunderstood.

So, if my IP is blacklisted, can I always retrieve the reports (even if 
reporter's id is munged), so that I can determine whether I'm at fault, 
there's something running amok on my network, or that the reporter is in 
error?

If so, that's as I understand it always has been and perhaps that's the 
best way for things to be. That said, I'd still like to see facilities for 
end users with static IP addresses to complain about false reports and to 
request delisting after they've erradicated any malware that was causing a 
problem.

-- 
Geoff Lane
Cornwall, UK
From wb8tyw at qsl.network  Tue Jan 25 13:34:01 2005
From: wb8tyw at qsl.network (John E. Malmberg)
Date: Tue Jan 25 14:35:04 2005
Subject: [SC-Help] Re: Paul Hwang is out of the office.
References: <mailman.68.1106326937.4572.spamcop-help@news.spamcop.net>
	<csrg52$c83$1@news.spamcop.net> <Xns95E5D25E427D6blammo@216.154.195.61>
	<csssnm$9e0$1@news.spamcop.net> <ct4g6c$5vl$1@news.spamcop.net>
Message-ID: <ZL$0b6Q1R0v0@eisner.encompasserve.org>

In article <ct4g6c$5vl$1@news.spamcop.net>,
Bert Driehuis <driehuis.fcnzpbc2005@playbeing.com> writes:
> John E. Malmberg wrote:
>
>> A U.S. TV news show some years back demonstrated to the horror of the
>> company executive that authorized the test how easy it was to get his
>> help desk to give the private investigator everything that he needed to
>> dial and log into an executive level account on their computer.  The
>> executive thought that the test would be a technological attack, not
>> just calling and asking to be let in.
>
> You wouldn't happen to know which TV show? For reasons unbeknownst to
> me, managers seem to take advice more easily from a talking head than
> from a newsgroup.

I do not remember that information.  It was quite a while ago.  I have
less than a 25% chance of guessing it correctly.

Security policy was changed at that company before the segment was aired :-)

-John
wb8tyw@qsl.network
Personal Opinion Only
From MikeE at ster.invalid  Tue Jan 25 12:44:05 2005
From: MikeE at ster.invalid (Mike Easter)
Date: Tue Jan 25 15:45:05 2005
Subject: [SC-Help] Re: Wrongly accused
References: <Xns95E8E243CF17Agjctcswxnsrt@216.154.195.61>
	<ct42do$q44$1@news.spamcop.net> <Xns95E9D1F415E7gjctcswxnsrt@216.154.195.61>
	<ct4ko6$9tk$1@news.spamcop.net> <Xns95E986003207gjctcswxnsrt@216.154.195.61>
	<ct5m13$vn4$1@news.spamcop.net> <Xns95E9B195E77B1gjctcswxnsrt@216.154.195.61>
	<Xns95E9BD8AF7780xnddmxn@216.154.195.61>
	<Xns95E9BBE4CABBFgjctcswxnsrt@216.154.195.61>
Message-ID: <ct6b2h$hdm$1@news.spamcop.net>

Geoff Lane wrote:
> So, if my IP is blacklisted, can I always retrieve the reports (even
> if reporter's id is munged), so that I can determine whether I'm at
> fault, there's something running amok on my network, or that the
> reporter is in error?

The recipient of reports is based on what is in SC's database for the
report.

The algorithm's strategy for source reports is based on the RiR,
regional internet registries ie arin, apnic, ripe, lacnic - or sometimes
other subregistries - tech and/or admin contacts based on the IP address
or the abuse.net lookup for the domainname - or additional notifieds put
into the db by the routing db deputy's input.

As a result, sometimes someone is affected by a report who doesn't
receive the report itself.

> If so, that's as I understand it always has been and perhaps that's
> the best way for things to be. That said, I'd still like to see
> facilities for end users with static IP addresses to complain about
> false reports and to request delisting after they've erradicated any
> malware that was causing a problem.

That would be especially important or worthwhile if the recipient of the
report acts irresponsibly or inappropriately.

-- 
Mike Easter
kibitzer, not SC admin

From geoff at nospam.gjctech.co.uk  Tue Jan 25 22:17:36 2005
From: geoff at nospam.gjctech.co.uk (Geoff Lane)
Date: Tue Jan 25 17:20:03 2005
Subject: [SC-Help] Re: Wrongly accused
References: <Xns95E8E243CF17Agjctcswxnsrt@216.154.195.61>
	<ct42do$q44$1@news.spamcop.net> <Xns95E9D1F415E7gjctcswxnsrt@216.154.195.61>
	<ct4ko6$9tk$1@news.spamcop.net> <Xns95E986003207gjctcswxnsrt@216.154.195.61>
	<ct5m13$vn4$1@news.spamcop.net> <Xns95E9B195E77B1gjctcswxnsrt@216.154.195.61>
	<Xns95E9BD8AF7780xnddmxn@216.154.195.61>
	<Xns95E9BBE4CABBFgjctcswxnsrt@216.154.195.61> <ct6b2h$hdm$1@news.spamcop.net>
Message-ID: <Xns95E9E387CEACEgjctcswxnsrt@216.154.195.61>

"Mike Easter" <MikeE@ster.invalid> wrote in
news:ct6b2h$hdm$1@news.spamcop.net: 

> The recipient of reports is based on what is in SC's database for the
> report.
> 
> The algorithm's strategy for source reports is based on the RiR,
> regional internet registries ie arin, apnic, ripe, lacnic - or
> sometimes other subregistries - tech and/or admin contacts based on
> the IP address or the abuse.net lookup for the domainname - or
> additional notifieds put into the db by the routing db deputy's input.
> 
> As a result, sometimes someone is affected by a report who doesn't
> receive the report itself.

I'm not talking about direct SC reports to the registered abuse address
here. I'm talking about where you find that your message has been
rejected and you check whether your IP is listed in the SBL. You
discover that it is listed but you haven't received any reports. At that
point, you're in the same boat as I was with my ISP. 

I've just run a test using the IP address of a host that I know is
listed. Although I discovered it was listed, I could not access any
samples of the spam. Thus if it were my IP and I knew that I hadn't
personally sent any spam, I would not be able to get any insight into 
root of the problem; I wouldn't be able to identify whether I'd been
joe-jobbed, there was some malware loose on my network; or whether some
pill*ck had submitted false reports. 

IOW, I'd have been convicted without benefit of trial, without sight of
the evidence, and without redress. 

-- 
Geoff Lane
Cornwall, UK
From nobody at devnull.spamcop.net  Tue Jan 25 16:34:19 2005
From: nobody at devnull.spamcop.net (Cat)
Date: Tue Jan 25 17:35:04 2005
Subject: [SC-Help] Re: Wrongly accused
In-Reply-To: <Xns95E986003207gjctcswxnsrt@216.154.195.61>
References: <Xns95E8E243CF17Agjctcswxnsrt@216.154.195.61>
	<ct42do$q44$1@news.spamcop.net> <Xns95E9D1F415E7gjctcswxnsrt@216.154.195.61>
	<ct4ko6$9tk$1@news.spamcop.net> <Xns95E986003207gjctcswxnsrt@216.154.195.61>
Message-ID: <ct6hh1$msq$1@news.spamcop.net>

Geoff Lane wrote:
> Cat <nobody@devnull.spamcop.net> wrote in news:ct4ko6$9tk$1
> @news.spamcop.net:
> 
> 
>>Your ISP is behaving 
>>irresponsibly and trying to put the blame on someone else.
>>
> 
> 
> Behaving irresponsibly? Perhaps. Not meeting their obligations to their 
> customers? Probably. However, I don't believe they are trying to put the 
> blame on someone else. They are stating a fact of their business: they 
> don't have the resources to read every complaint they get from Spamcop.

They're the abuse department at an ISP. Their job is to investigate all 
complaints that come in. Blindly taking action on complaints without 
investigating what should be the proper action, which leads to their 
customers (in this case, you) complaining to SpamCop, which places the 
blame on SpamCop when it's the ISP's fault.

> Right now all their CGI servers are blacklisted (I suspect with good 
> reason). I've seen some claims that I find disturbing on that subject. 
> For an example, see http://tinyurl.com/3sw24 (.) So PlusNet do have a 
> much bigger spam problem, as you suggest. However, they are doing 
> something about the CGI servers and have scheduled downtime for fully 
> rebuilding them.

I've had spam a couple of times from PlusNet users before. I vaguely 
remember that they seemed to be separate incidents, so I couldn't tell 
how quickly the ISP took action. I can't judge from that alone the size 
of their spam problem, but the CGI server issue and their trigger happy 
attitude with claims that they don't have the resources to investigate 
every complaint would suggest that they have a spam problem which they 
aren't managing properly.

> That said, last night Spamcop had at least one of those CGI servers 
> blacklisted with a claim that it would be delisted in zero hours -- and 
> that claim was there for three hours. Now a claim that a host will be 
> delisted in zero hours can legitimately be valid for a maximum of one 
> hour, so Spamcop also has problems and cannot automatically be assumed 
> blameless.
> 
> WRT the concept of behaving irresponsibly, what makes you think that 
> Spamcop has any less responsibility for ensuring that it's reports are 
> accurate than does the ISP? An unwarranted inclusion in the Spamcop BL is 
> far more serious and potentially far more damaging than a single report 
> inappropriately acted upon by one ISP. As I've discovered, someone with 
> malintent (or even someone who is mistaken) can easily use Spamcop as a 
> means to damage a victim. Spamcop does not even provide easy means for 
> the victim to highlight the injustice, and I suspect would not take 
> speedy action if it did.

 From past discussions here, SpamCop does not list a server based on one 
complaint. If PlusNet's servers are listed, it's because of more than 
one complaint. SpamCop is only a tool used by people to find the correct 
reporting address from spam. SpamCop's users are told to behave 
responsibly, and SpamCop will take action against users who file false 
complaints when they are notified with evidence that one of their users 
falsely complained. If your ISP threatens to cut you off due to a false 
complaint that they didn't bother to investigate properly, that's their 
own fault, not the fault of SpamCop. This is why I said that your ISP is 
placing blame for their irresponsibility wrongfully on SpamCop.

> Spamcop's help for abuse desks states that they don't have the resources 
> to verify each report.

Like I said before, SpamCop is a tool that people use to send complaints 
directly to the ISP through SpamCop. Complaints do not pass through a 
human at SpamCop before being sent to the ISPs. It's the ISP's 
responsibility to investigate complaints properly.

> What makes you think that an ISP should be any 
> different? That an ISP should be forced to finance additional people to 
> counter errors or even malintent from Spamcop and its users? If Spamcop 
> actually had credible quality control, those ISP resources would not be 
> necessary, and so it is Spamcop's lack of quality control that is costing 
> ISPs and their customers dearly.

It's the ISP abuse admin's job to investigate spam complaints. SpamCop 
does its part to educate its users on the consequenses of sending false 
complaints and will take action against users who file false complaints. 
You're still wrongfully placing blame on SpamCop for your ISP's 
irresponsible behavior. SpamCop did not hold a gun to PlusNet's abuse 
admin's head forcing him/her to threaten to cut you off without proof. 
As an ISP, it is their responsibility to investigate spam complaints 
that they receive. If an ISP is going to operate, then it is the ISP's 
responsibility to have a properly working abuse department. Please stop 
blaming SpamCop for something that is your ISP's fault.
From MikeE at ster.invalid  Tue Jan 25 15:05:28 2005
From: MikeE at ster.invalid (Mike Easter)
Date: Tue Jan 25 18:10:05 2005
Subject: [SC-Help] Re: Wrongly accused
References: <Xns95E8E243CF17Agjctcswxnsrt@216.154.195.61>
	<ct42do$q44$1@news.spamcop.net> <Xns95E9D1F415E7gjctcswxnsrt@216.154.195.61>
	<ct4ko6$9tk$1@news.spamcop.net> <Xns95E986003207gjctcswxnsrt@216.154.195.61>
	<ct5m13$vn4$1@news.spamcop.net> <Xns95E9B195E77B1gjctcswxnsrt@216.154.195.61>
	<Xns95E9BD8AF7780xnddmxn@216.154.195.61>
	<Xns95E9BBE4CABBFgjctcswxnsrt@216.154.195.61> <ct6b2h$hdm$1@news.spamcop.net>
	<Xns95E9E387CEACEgjctcswxnsrt@216.154.195.61>
Message-ID: <ct6jbk$o9l$1@news.spamcop.net>

Geoff Lane wrote:
> I'm not talking about direct SC reports to the registered abuse
> address here.

However, we /started/ this thread talking about a spamcop report going
to a provider's abuse desk which caused a series of events.

>  I'm talking about where you find that your message has
> been rejected and you check whether your IP is listed in the SBL.

When that is the sequence, which is different from a 'handling' point of
view, you are not 'empowered' to fix the problem if you are not the role
account for the report.  That means that if you are not the role
account, you can't fix it.  The role account, such as the pm or such, is
supposed to be dealing with the problem.

> You
> discover that it is listed but you haven't received any reports. At
> that point, you're in the same boat as I was with my ISP.

If you aren't the role account for the reports, you don't get the
reports and you don't get the evidence, unless someone passes it on to
you.


-- 
Mike Easter
kibitzer, not SC admin

From geoff at nospam.gjctech.co.uk  Wed Jan 26 08:40:07 2005
From: geoff at nospam.gjctech.co.uk (Geoff Lane)
Date: Wed Jan 26 03:45:03 2005
Subject: [SC-Help] Re: Wrongly accused
References: <Xns95E8E243CF17Agjctcswxnsrt@216.154.195.61>
	<ct42do$q44$1@news.spamcop.net> <Xns95E9D1F415E7gjctcswxnsrt@216.154.195.61>
	<ct4ko6$9tk$1@news.spamcop.net> <Xns95E986003207gjctcswxnsrt@216.154.195.61>
	<ct5m13$vn4$1@news.spamcop.net> <Xns95E9B195E77B1gjctcswxnsrt@216.154.195.61>
	<Xns95E9BD8AF7780xnddmxn@216.154.195.61>
	<Xns95E9BBE4CABBFgjctcswxnsrt@216.154.195.61> <ct6b2h$hdm$1@news.spamcop.net>
	<Xns95E9E387CEACEgjctcswxnsrt@216.154.195.61> <ct6jbk$o9l$1@news.spamcop.net>
Message-ID: <Xns95EA58EE64390gjctcswxnsrt@216.154.195.61>

"Mike Easter" <MikeE@ster.invalid> wrote in
news:ct6jbk$o9l$1@news.spamcop.net: 

>>  I'm talking about where you find that your message has
>> been rejected and you check whether your IP is listed in the SBL.
> 
> When that is the sequence, which is different from a 'handling' point
> of view, you are not 'empowered' to fix the problem if you are not the
> role account for the report.  That means that if you are not the role
> account, you can't fix it.  The role account, such as the pm or such,
> is supposed to be dealing with the problem.
> 
>> You
>> discover that it is listed but you haven't received any reports. At
>> that point, you're in the same boat as I was with my ISP.
> 
> If you aren't the role account for the reports, you don't get the
> reports and you don't get the evidence, unless someone passes it on to
> you.

WRT "role accounts" - I assume you mean the tech, admin, and abuse
addresses registered at RIPE et al. Now, you send mail to
postmaster@mydomain and it ends up in my inbox; you send mail to
webmaster@mydomain or hostmaster@mydomain or even abuse@mydomain and it
ends up in my inbox. However, abuse reports aren't sent to "mydomain";
they are sent to my ISP's abuse desk, which is the address registered at
RIPE for my IP. 

If there is a problem on my network, I need to know so that I can fix
it. My ISP can't fix it -- they can only suspend or terminate my
account. Of course, they can help by passing to me any reports
unaltered, which is something they are not inclined to do, but they
can't fix it. It is absolutely absurd to suggest that only a role
account is able to fix problems, particularly if the cause is malware or
an open relay. Unless they have access to the network that is hosting
the problem (which, thankfully, they don't) they have a snowball's
chance in h*ll of fixing it. 

Now exactly the same situation is true of millions of other people out
there with static IP addresses. With Spamcop, you have the possibility
of your IP being blacklisted. The blacklisting doesn't affect anyone
else and you don't know about it until (say) you phone someone to ask
why they haven't responded to your message. You enter your IP into SC's
"am I listed" page and find that you're on the list. However, you have
absolutely no way of identifying the root of the problem with certainty
because you do not have access to the reports. 

IOW, you have been convicted without benefit of trial, without sight of
the evidence, and with no redress. Personally, I'd say that possibility
puts more responsibility on Spamcop for ensuring the validity of its
reports than the responsibility any ISP may have with respect to report
validity. The only potential mitigation I could see here would be for SC
to make those reports available to the accused. 

-- 
Geoff Lane
Cornwall, UK
From geoff at nospam.gjctech.co.uk  Wed Jan 26 08:46:27 2005
From: geoff at nospam.gjctech.co.uk (Geoff Lane)
Date: Wed Jan 26 03:50:03 2005
Subject: [SC-Help] Re: Wrongly accused
References: <Xns95E8E243CF17Agjctcswxnsrt@216.154.195.61>
	<ct42do$q44$1@news.spamcop.net> <Xns95E9D1F415E7gjctcswxnsrt@216.154.195.61>
	<ct4ko6$9tk$1@news.spamcop.net> <Xns95E986003207gjctcswxnsrt@216.154.195.61>
	<ct6hh1$msq$1@news.spamcop.net>
Message-ID: <Xns95EA5A016B51Cgjctcswxnsrt@216.154.195.61>

Cat <nobody@devnull.spamcop.net> wrote in
news:ct6hh1$msq$1@news.spamcop.net: 

> They're the abuse department at an ISP. Their job is to investigate
> all complaints that come in. Blindly taking action on complaints
> without investigating what should be the proper action, which leads to
> their customers (in this case, you) complaining to SpamCop, which
> places the blame on SpamCop when it's the ISP's fault.

Let's get one thing absolutely straight here. At the head of this
thread, I wrote, "Although most of the problem was due to my ISP
(PlusNet) not acting reasonably and professionally, the whole thing was
started by a Spamcop user reporting as spam a post that I made to a
mailing list to which he had explicitly subscribed. I'm relating this
tale here to urge fellow users to take care when making those spam
reports..." 

Of course the ISP should investigate complaints properly. However, that 
doesn't absolve Spamcop or its users from a moral obligation to ensure that 
complaints are justified. I've given reasons for my opinion on this in 
another branch of this thread.

-- 
Geoff Lane
Cornwall, UK
From gospamming at yourdomain.invalid  Wed Jan 26 09:49:03 2005
From: gospamming at yourdomain.invalid (D.Diaz)
Date: Wed Jan 26 04:51:08 2005
Subject: [SC-Help] Re: Wrongly accused
References: <Xns95E8E243CF17Agjctcswxnsrt@216.154.195.61>
	<ct42do$q44$1@news.spamcop.net> <Xns95E9D1F415E7gjctcswxnsrt@216.154.195.61>
	<ct4ko6$9tk$1@news.spamcop.net> <Xns95E986003207gjctcswxnsrt@216.154.195.61>
	<ct5m13$vn4$1@news.spamcop.net> <Xns95E9B195E77B1gjctcswxnsrt@216.154.195.61>
	<Xns95E9BD8AF7780xnddmxn@216.154.195.61>
	<Xns95E9BBE4CABBFgjctcswxnsrt@216.154.195.61> <ct6b2h$hdm$1@news.spamcop.net>
	<Xns95E9E387CEACEgjctcswxnsrt@216.154.195.61> <ct6jbk$o9l$1@news.spamcop.net>
	<Xns95EA58EE64390gjctcswxnsrt@216.154.195.61>
Message-ID: <Xns95EA6E0A64566xnddmxn@216.154.195.61>

Geoff Lane <geoff@nospam.gjctech.co.uk> wrote in
news:Xns95EA58EE64390gjctcswxnsrt@216.154.195.61: 

> WRT "role accounts" - I assume you mean the tech, admin, and abuse
> addresses registered at RIPE et al. Now, you send mail to
> postmaster@mydomain and it ends up in my inbox; you send mail to
> webmaster@mydomain or hostmaster@mydomain or even abuse@mydomain and
> it ends up in my inbox. However, abuse reports aren't sent to
> "mydomain"; they are sent to my ISP's abuse desk, which is the address
> registered at RIPE for my IP. 
> 

That's right, the reports are being sent to the abuse@ or postmaster@
role accounts for the IP range affected.  Domains have nothing to do WRT
identification of the source of spam. 


> If there is a problem on my network, I need to know so that I can fix
> it. My ISP can't fix it -- they can only suspend or terminate my
> account. 

Well... that, in fact, is the fix for an ISP abuse desk <g>

> Now exactly the same situation is true of millions of other people out
> there with static IP addresses. With Spamcop, you have the possibility
> of your IP being blacklisted. The blacklisting doesn't affect anyone
> else and you don't know about it until (say) you phone someone to ask
> why they haven't responded to your message. You enter your IP into
> SC's "am I listed" page and find that you're on the list. However, you
> have absolutely no way of identifying the root of the problem with
> certainty because you do not have access to the reports. 
> 
> IOW, you have been convicted without benefit of trial, without sight
> of the evidence, and with no redress. Personally, I'd say that
> possibility puts more responsibility on Spamcop for ensuring the
> validity of its reports than the responsibility any ISP may have with
> respect to report validity. The only potential mitigation I could see
> here would be for SC to make those reports available to the accused. 
> 

If you have static IP addresses assigned to you and you have your domain
associated to them, you can ask SpamCop to send reports to you; just
create an ISP account and become a "3rd party interested in email
source": 

http://www.spamcop.net/fom-serve/cache/94.html
"How can I get SpamCop reports about my network?"

[quote]

Report routing 

Anyone may receive summary reports about any netspace they specify. To
receive reports, first create an ISP account. 

Once you have logged in with your new account, use the "Request Reports"
menu item to specify which networks you would like to receive reports
about. At any time, you may use the "show routes" menu item to view
which networks you are configured to receive reports about. 

In addition, your ISP account allows you to spot-check any IP address
for recent reports. 

[/quote]

In addition to this, you also have the possibility to request an
"express delisting" once for IP address right from the blocklisting
("Am I listed?") query page, if you are the admin for the listed IP. 

And last, but not least, there are the deputies who can be reached at
deputies[at]admin.spamcop.net. If you need more detail about the causes
of a listing, you can write to them, and they will be able to work with
you to solve the issue, making more data available to you.

-- 
Daniel Diaz
SpamCop User
From MikeE at ster.invalid  Wed Jan 26 03:09:12 2005
From: MikeE at ster.invalid (Mike Easter)
Date: Wed Jan 26 06:10:23 2005
Subject: [SC-Help] Re: Wrongly accused
References: <Xns95E8E243CF17Agjctcswxnsrt@216.154.195.61>
	<ct42do$q44$1@news.spamcop.net> <Xns95E9D1F415E7gjctcswxnsrt@216.154.195.61>
	<ct4ko6$9tk$1@news.spamcop.net> <Xns95E986003207gjctcswxnsrt@216.154.195.61>
	<ct5m13$vn4$1@news.spamcop.net> <Xns95E9B195E77B1gjctcswxnsrt@216.154.195.61>
	<Xns95E9BD8AF7780xnddmxn@216.154.195.61>
	<Xns95E9BBE4CABBFgjctcswxnsrt@216.154.195.61> <ct6b2h$hdm$1@news.spamcop.net>
	<Xns95E9E387CEACEgjctcswxnsrt@216.154.195.61> <ct6jbk$o9l$1@news.spamcop.net>
	<Xns95EA58EE64390gjctcswxnsrt@216.154.195.61>
Message-ID: <ct7toi$mu3$1@news.spamcop.net>

Geoff Lane wrote:
> "Mike Easter"

>> If you aren't the role account for the reports, you don't get the
>> reports and you don't get the evidence, unless someone passes it on
>> to you.
>
> WRT "role accounts" - I assume you mean the tech, admin, and abuse
> addresses registered at RIPE et al. Now, you send mail to
> postmaster@mydomain and it ends up in my inbox; you send mail to
> webmaster@mydomain or hostmaster@mydomain or even abuse@mydomain and
> it ends up in my inbox. However, abuse reports aren't sent to
> "mydomain"; they are sent to my ISP's abuse desk, which is the
> address registered at RIPE for my IP.

We need to get more specific rather than hypothetical, and you have
already posted the headers of an email from you here.  We are talking
about gjctech.co.uk

When I send a mail /to/ gjctech.co.uk, it actually goes to plus.net's
servers:

Mail for gjctech.co.uk is handled by mx.last.plus.net & mx.core.plus.net
and those are 212.159.11.36  and  212.159.6.18 which live in this plus
space

inetnum:      212.159.8.0 - 212.159.11.255
netname:      PLUSNET-VISP-SERVERS
descr:        Virtual ISP Portal servers
descr:        PlusNet Technologies Ltd

When you send a mail /from/ gjctech, you also use plus's IPs

80.229.38.243 (helo=colossus)

80.229.38.243 rDNS gjctech.plus.com
which lives in this plus space

inetnum:      80.229.32.0 - 80.229.47.255
netname:      PLUSNET-DIAL-ADSL
descr:        Dial-up and ADSL pool
descr:        PlusNet Technologies Ltd

The notifies for anything involving those netblocks are going to go to
abuse@plus.net

I think you are wishing that the SC strategy for the notify would be
based on the domainname, for which you can register a contact at
abuse.net...

whois -h whois.abuse.net gjctech.co.uk ...
postmaster@gjctech.co.uk (default, no info)
No abuse address is registered with abuse.net
  Complaints should go to abuse@(the domain) with copies to
postmaster@(the domain) (Including a suggestion that they register with
abuse.net, by emailing update@abuse.net might be a good idea too)

...but in fact, even if you were a spamvertiser

gjctech.co.uk DNS 212.159.8.1

which is that PLUSNET-VISP-SERVERS shown above and that is who would be
notified.

Daniel has described the process by which someone can become an
additional notified for some IP block.


-- 
Mike Easter
kibitzer, not SC admin

From geoff at nospam.gjctech.co.uk  Wed Jan 26 12:33:04 2005
From: geoff at nospam.gjctech.co.uk (Geoff Lane)
Date: Wed Jan 26 07:35:24 2005
Subject: [SC-Help] Re: Wrongly accused
References: <Xns95E8E243CF17Agjctcswxnsrt@216.154.195.61>
	<ct42do$q44$1@news.spamcop.net> <Xns95E9D1F415E7gjctcswxnsrt@216.154.195.61>
	<ct4ko6$9tk$1@news.spamcop.net> <Xns95E986003207gjctcswxnsrt@216.154.195.61>
	<ct5m13$vn4$1@news.spamcop.net> <Xns95E9B195E77B1gjctcswxnsrt@216.154.195.61>
	<Xns95E9BD8AF7780xnddmxn@216.154.195.61>
	<Xns95E9BBE4CABBFgjctcswxnsrt@216.154.195.61> <ct6b2h$hdm$1@news.spamcop.net>
	<Xns95E9E387CEACEgjctcswxnsrt@216.154.195.61> <ct6jbk$o9l$1@news.spamcop.net>
	<Xns95EA58EE64390gjctcswxnsrt@216.154.195.61> <ct7toi$mu3$1@news.spamcop.net>
Message-ID: <Xns95EA806D55D95gjctcswxnsrt@216.154.195.61>

"Mike Easter" <MikeE@ster.invalid> wrote in news:ct7toi$mu3$1
@news.spamcop.net:

> The notifies for anything involving those netblocks are going to go to
> abuse@plus.net

... and that's the problem. Other than suspending or terminating my 
account, my ISP can do nothing to resolve the problem. For that, they 
can't even guarantee there is a problem. Unless they actually tell me 
there is a complaint, I probably won't even know there is a problem. 
(Moreover, if SC don't tell PN  ... but that's another issue, albeit IMO 
a compelling reason why Spamcop must take more responsibility than it 
does).

I read and agree with everything you say regarding the mechanics of the 
thing. However, the fact remains that innocent parties are being 
convicted with neither trial nor recourse. Their livelihoods can even be 
insidiously damaged by Spamcop and its users.

Now I understand what you're saying about registering as a third party 
etc. However, after having a free reporting account for several years, 
I've only just found out that, and it most certainly wasn't instinctive 
to me that I should or could do that. It has taken this rather protracted 
thread for that to come to light. I suspect that an average user wouldn't  
find that information. That said, I've now created an ISP account at 
Spamcop and still have no idea how to register as a "third party".

While I have no doubt that Spamcop is doing much good in the war against 
spam, I seriously doubt that it is doing all it has a moral obligation to 
do to avoid "collateral damage".

-- 
Geoff Lane
Cornwall, UK
From nobody at spamcop.net  Wed Jan 26 07:59:41 2005
From: nobody at spamcop.net (Miss Betsy)
Date: Wed Jan 26 08:00:03 2005
Subject: [SC-Help] If you have been blocked by SpamCop, please read
Message-ID: <ct841k$r3e$1@news.spamcop.net>

Why Am I Blocked? Probable Causes
If your email has suddenly been blocked by the SpamCop blocklist,
it is probably because you share an IP address with other email
users and there is someone who:

    * is using auto-responses that are replying to spam with forged
spamtrap email
      addresses (such as Out-of-Office/Vacation notices, virus
notifications, and 'created email' bounces);
    * has a computer with a virus that sends spam without the
owner's knowledge;
    * has a computer that has been compromised and spammers are
remotely controlling it to transmit their spew;
    * is sending unsolicited emails and your internet service
provider is allowing it;
    * or because, as in all systems, there may have been a mistake.
(very rare)

The SpmCopDNSbl listing will expire automatically within 48 hours
of the last report of spam from it.

For people who are operating servers:
Am I really listed in the SpamCop Blocklist?:
You can check the status of any server by entering its address at
http://www.spamcop.net/bl.shtml. The reason an IP address is listed
can also be obtained from that page.

If the blocklist only lists spamtraps, then auto responses are the
likely culprit.
If the blocklist only lists reports, you have a spammer at work.
If the blocklist lists spam traps and reports,

    * You have your firewall configured to allow a compromised
machine on your network to spew to the world
      (you do have a firewall in place, don't you?)
    * the SMTP/Auth exploit of an Exchange server is in progress,
see these links:
      http://news.spamcop.net/cgi-bin/fom?file=372
      http://www.winnetmag.com/article/articleid/40507/40507.html
      http://www.winnetmag.com/article/articleid/42406/42406.html
      How To Block Open SMTP Relaying and Clean Up Exchange Server
SMTP Queues
      To prevent SMTP relaying with Microsoft Exchange Server

Please also see:

    * How can I get removed from SpamCop's blocking system?
    * John's explanation at John's revised post, for Why Am I
Blocked FAQ
    * Merlyn's explanation at FAQ Entry: Why is my email blocked?

The rest of this FAQ is for people who do not run servers. Post the
IP address that is blocked in the Spamcop web forum or newsgroup.
There are many knowledgeable people in the SpamCop groups who will
help you figure out why and offer solutions. If you need to know
what triggered the report from a spamtrap, email deputies <at>
spamcop.net. Only they can see. However, a post will generally get
you faster replies and more specific help on what is the problem.

For people whose email was returned
Q: What does SpamCop do with my email? A: Nothing
The Internet Service Provider (ISP) of the person, or business, you
are sending email "To" is blocking email from your ISP's computers
(servers), using a list provided by SpamCop.
Your email doesn't pass through SpamCop's mail servers and SpamCop
has no way of blocking or bouncing your email.
In addition, the SpamCop email service uses the blocklist to "tag"
incoming mail so that suspected spam is placed in a particular
folder and that is the way the blocklist is intended to be used.

Q: What is a blocklist? A: A blocklist helps ISP’s to prevent spam
coming to their customers.
An ISP can use a blocklist (a list of IP addresses),to block
(bounce back) all email coming from a particular IP address.
The blocking is based not on your email address (which looks like
username@example.com), but on the IP address (which looks like
198.162.250.196).

This IP address is assigned to the mail server you use, which is
probably run by your ISP. You may share this same server with
hundreds or thousands of other customers. If one of the other
customers is sending spam through that shared mail server, it will
cause the IP address of that mail server to be put on the
blocklist. And when you send email through that server, ISP’s who
use blocklists to avoid receiving spam, will also block your email.

SpamCop is one of many blocklists. DNS Blackhole Lists (DNSBLs) is
a link to page that lists and categorizes a number of blocklists.
Trying to describe the difference between spamcop & other lists
(particularly the time it takes to get off the list) and how
SpamCop can be an early warning system for ISP's is a bit
difficult, as each is different in concept, targets, results
ranges, and oversight. If more specific data is desired on other
DNSBLs, please visit that listing site.

Q: What is SpamCop? A: Unique, automated blocklist and spam
filtering
SpamCop has a program that will find the correct address to send a
complaint because the email address you see that says who it is
from is often forged by spammers. SpamCop finds the correct IP
address and forwards complaints for its members. If a lot of
reports are made, the IP address goes on the SpamCop blocklist that
is used by many ISP’s. for more detailed information on how Spamcop
works see: http://www.spamcop.net/fom-serve/cache/3.html


Q: How do ISP’s use SpamCop A: As 1) a warning that spammers have
slipped by their defenses and 2) to block spam.
1) Responsible ISP's welcome SpamCop reports and will remove
spammers quickly from their systems.
2)When they block emails, they send a message that looks like this:
451 Blocked - see
http://www.spamcop.net/bl.shtml?xxxx.xxxx.xxxx.xxxx:
or
email from xxx.com blocked,refused by Spamcop,see
http://www.spamcop.net

Q: Why me? A: It Happens to the best of us
It is annoying to have your email blocked. It is also annoying to
have a backhoe interrupt email service.

However, until the blocking problem is resolved, you can email
people through a web based email service (the most familiar web
based email services are hotmail and yahoo).

After you have taken care of the immediate problem of being able to
communicate with someone by email, the next step is to see what can
be done so this inconvenience does not happen to you again.

The one thing you do not want to do is to complain to those
correspondents who are using an email service that uses the SpamCop
blocklist. They probably really like the reduction in spam!

You have the responsibility to see that your ISP provides you with
reliable email service.
See this link for a longer explanation of costs
http://forum.spamcop.net/forums/index.php?showtopic=660

Q: Who do I contact to correct this problem? A: Your ISP (email
service provider) first
Usually the ISP with the blocked IP address has also been notified
with the evidence of spam reports. Your ISP may have already acted
on the Spamcop report they have received by the time you call. It
may just have been a mistake on their part or, possibly, the
reporter's part. Reporters can be fined or banned for mistakes.

As soon as your ISP stops the spam from being sent, or uses the
procedures at SpamCop to point out the reporter's mistake, the IP
address is taken off the blocklist (usually within 48 hours for
spam; immediately for reporter error).

It may be that your call is the first time your ISP has heard that
SpamCop has listed your IP address. Listings are made, in addition
to member reporting, automatically from spamtraps (an eMail address
that is not used, nor published anywhere, so only gets eMail if
someone is sending spam!).

Your ISP can find out about SpamCop at
http://www.spamcop.net/fom-serve/cache/76.html if they don’t
already know about SpamCop.

SpamCop deputies have access to the full evidence for a listing.
Deputies can delist IP addresses which are listed in error.

Q: My ISP says it’s not their fault. A: People in this forum will
help with information to give your ISP
You will need to know your IP address for people to understand what
has happened (it should be in the message you received telling you
your mail was blocked).
It is also helpful to know the reasons why it was blocked. (To do
this, go to http://www.spamcop.net/bl.shtml. Make a note of the
reason for the listing. For example "Been reported as a source of
spam about 30 times" "Been detected sending mail to spam traps" as
this is important)
There are many people who will explain to you what has happened and
what you can do.

If you are interested in finding out more about blocklists and
exactly why your email was blocked, you may post
in the web forum http://forum.spamcop.net/forums/index.php?act=idx
or in the SpamCop NNTP newsgroup
news://news.spamcop.net/spamcop.help with the above information.

Please remember that this block is not aimed at you personally.
There are a limited number of IP addresses on the Internet, so you,
and the spammer, may get a different one each time you log-on. Your
Internet Service Provider is the only one who can investigate and
take action to stop spam from coming from that IP address. In the
meantime, the email service at the other end does not have to
accept your email until spam has stopped coming from that
particular IP address just as postal and package services can
refuse certain types of mail and packages.


Revised 18 Nov 2004 - Wazoo added DNSBL List URL
Revised 16 Nov 2004 - Wazoo - Ouch! newsgroup link fixed!
Revised 2 Sep 2004 - Wazoo
Revised August 7, 2004 - Miss Betsy, Wazoo, dbiel
Edited per Wazoo comments March 6, 2004 rev March 7 rev Mar 8 for
format (agsteele) Rev Mar11 with more links Rev Mar 12 with new
John link rev 13 listized "Probable Causes" rev 14 consolidated
some links
Contributors: Michaell, Mike Easter, Wazoo, Greenlady, John, JT,
JeffG


From MikeE at ster.invalid  Wed Jan 26 05:03:27 2005
From: MikeE at ster.invalid (Mike Easter)
Date: Wed Jan 26 08:05:03 2005
Subject: [SC-Help] Re: Wrongly accused
References: <Xns95E8E243CF17Agjctcswxnsrt@216.154.195.61>
	<ct42do$q44$1@news.spamcop.net> <Xns95E9D1F415E7gjctcswxnsrt@216.154.195.61>
	<ct4ko6$9tk$1@news.spamcop.net> <Xns95E986003207gjctcswxnsrt@216.154.195.61>
	<ct5m13$vn4$1@news.spamcop.net> <Xns95E9B195E77B1gjctcswxnsrt@216.154.195.61>
	<Xns95E9BD8AF7780xnddmxn@216.154.195.61>
	<Xns95E9BBE4CABBFgjctcswxnsrt@216.154.195.61> <ct6b2h$hdm$1@news.spamcop.net>
	<Xns95E9E387CEACEgjctcswxnsrt@216.154.195.61> <ct6jbk$o9l$1@news.spamcop.net>
	<Xns95EA58EE64390gjctcswxnsrt@216.154.195.61> <ct7toi$mu3$1@news.spamcop.net>
	<Xns95EA806D55D95gjctcswxnsrt@216.154.195.61>
Message-ID: <ct84eo$rg9$1@news.spamcop.net>

Geoff Lane wrote:
> That said, I've now
> created an ISP account at Spamcop and still have no idea how to
> register as a "third party".

I don't know for sure that all of your mail would come from
80.229.38.243 rDNS gjctech.plus.com - but that's at least one IP address
you might want to hear about.

Another one at the present time would be the one where the website is
currently 212.159.9.131

The problem with the website one is that that IP's 'other' name is
homepages.plus.net and there are also other domainnames which are
sharing that same IP.

Also, the 'assignment' of either one might have dynamics which are
beyond your control.  That is, you might be asking to hear about reports
affecting an IP, and then the IP gets changed.

> While I have no doubt that Spamcop is doing much good in the war
> against spam, I seriously doubt that it is doing all it has a moral
> obligation to do to avoid "collateral damage".

I'm sure there are a lot of instances of SC collateral damage, but let's
don't forget the original issue and how it evolved.

A spamcop reporter inappropriately reported a mailing list item which
you mailed, and the report went to plus.  Plus should have evaluated it
and determined it to be not spam from you and responded to spamcop, not
you.  The SC report instructs about responding.

Plus.net having done its job more appropriately, the spamcop admin
could/might admonish the reporter appropriately and glance at whether or
not the report had caused the/your IP to be SC blocklisted, which it
didn't/hadn't, but if it had, the 'subtraction' of the wrong report
would unlist the IP - unless it was /supposed/ to be listed for other
spams.

Instead, the 'evolution' of the report causing your provider to
notify/chastise you inappropriately and then for you to react
inappropriately or excessively or whatever word you like by shutting
down something/everything for a time was outawhack.  The unintended
consequences of a relatively minor reporter error which inconvenienced
you were entirely the doing of your provider and then you.

Spamcop reports run on 'autopilot' - reporters are instructed how to
behave and then they behave however they behave.  Ostensibly 'bad'
reporters would be remedied by the structure for that.  Another
potential 'bad' reporter might be a spamtrap running on autopilot.  If
there is a bad spamtrap report sequence which causes a listing and mail
to bounce, the structure would lead to a deputy getting involved on a
human level and undoing the damage or the listing.

-- 
Mike Easter
kibitzer, not SC admin

From geoff at nospam.gjctech.co.uk  Wed Jan 26 13:42:52 2005
From: geoff at nospam.gjctech.co.uk (Geoff Lane)
Date: Wed Jan 26 08:45:03 2005
Subject: [SC-Help] Re: Wrongly accused
References: <Xns95E8E243CF17Agjctcswxnsrt@216.154.195.61>
	<ct42do$q44$1@news.spamcop.net> <Xns95E9D1F415E7gjctcswxnsrt@216.154.195.61>
	<ct4ko6$9tk$1@news.spamcop.net> <Xns95E986003207gjctcswxnsrt@216.154.195.61>
	<ct5m13$vn4$1@news.spamcop.net> <Xns95E9B195E77B1gjctcswxnsrt@216.154.195.61>
	<Xns95E9BD8AF7780xnddmxn@216.154.195.61>
	<Xns95E9BBE4CABBFgjctcswxnsrt@216.154.195.61> <ct6b2h$hdm$1@news.spamcop.net>
	<Xns95E9E387CEACEgjctcswxnsrt@216.154.195.61> <ct6jbk$o9l$1@news.spamcop.net>
	<Xns95EA58EE64390gjctcswxnsrt@216.154.195.61> <ct7toi$mu3$1@news.spamcop.net>
	<Xns95EA806D55D95gjctcswxnsrt@216.154.195.61> <ct84eo$rg9$1@news.spamcop.net>
Message-ID: <Xns95EA8C4272D10gjctcswxnsrt@216.154.195.61>

"Mike Easter" <MikeE@ster.invalid> wrote in news:ct84eo$rg9$1
@news.spamcop.net:

> I don't know for sure that all of your mail would come from
> 80.229.38.243 rDNS gjctech.plus.com - but that's at least one IP address
> you might want to hear about.

That's the one I'm most interested in. However, I can't find a way to 
automatically receive full SC reports that cite this IP address.

As you imply, signing up to receive complaints about my ISP's homepages 
servers or CGI servers is the path the misery. So, I would like to receive 
daily summary reports for the ones that are hosting two of my domains. 

FWIW, I've just tried adding aggregate reports for the above IP address, 
together with the two servers that currently host my website pages. For 
each, Spamcop responded "Trouble parsing <ip addy>" and couldn't add the 
route.

I've wasted far too much time on this already. Spamcop just isn't usable to 
us mere mortals, yet it can cause considerable damage to innocent parties 
(and, for me, it has).

-- 
Geoff Lane
Cornwall, UK
From nobody at spamcop.net  Wed Jan 26 09:09:15 2005
From: nobody at spamcop.net (Miss Betsy)
Date: Wed Jan 26 09:10:02 2005
Subject: [SC-Help] Re: Wrongly accused
References: <Xns95E8E243CF17Agjctcswxnsrt@216.154.195.61>
	<ct42do$q44$1@news.spamcop.net> <Xns95E9D1F415E7gjctcswxnsrt@216.154.195.61>
	<ct4ko6$9tk$1@news.spamcop.net> <Xns95E986003207gjctcswxnsrt@216.154.195.61>
	<ct5m13$vn4$1@news.spamcop.net> <Xns95E9B195E77B1gjctcswxnsrt@216.154.195.61>
	<Xns95E9BD8AF7780xnddmxn@216.154.195.61>
	<Xns95E9BBE4CABBFgjctcswxnsrt@216.154.195.61> <ct6b2h$hdm$1@news.spamcop.net>
	<Xns95E9E387CEACEgjctcswxnsrt@216.154.195.61> <ct6jbk$o9l$1@news.spamcop.net>
	<Xns95EA58EE64390gjctcswxnsrt@216.154.195.61> <ct7toi$mu3$1@news.spamcop.net>
	<Xns95EA806D55D95gjctcswxnsrt@216.154.195.61> <ct84eo$rg9$1@news.spamcop.net>
	<Xns95EA8C4272D10gjctcswxnsrt@216.154.195.61>
Message-ID: <ct8843$u9b$1@news.spamcop.net>

<snip>
> I've wasted far too much time on this already. Spamcop just isn't
usable to
> us mere mortals, yet it can cause considerable damage to innocent
parties
> (and, for me, it has).

In today's world of spam, there are no innocent parties - just
ignorant ones - except those who receive spam (or forwarded bounces
to forged addresses).

If you had a host who knew what to do, then they would have
investigated and replied for you.  The problem here is that you do
not have a host who has not done what a responsible host would do.

It is difficult to get set up as an 'interested third party'
because the spammers have abused that also.

In the long run, it is the *sender* of email who has to be
responsible and competent (or to choose competent and responsible
providers) to combat spam.  It is not SpamCop who is causing any of
the problems - even when there is a mistaken report.  Mistaken
reports are easily dealt with if the person receiving the report
knows what to do.

Miss Betsy


From nobody at devnull.spamcop.net  Wed Jan 26 10:13:40 2005
From: nobody at devnull.spamcop.net (WazoO)
Date: Wed Jan 26 11:15:06 2005
Subject: [SC-Help] Re: If you have been blocked by SpamCop, please read
References: <ct841k$r3e$1@news.spamcop.net>
Message-ID: <ct8fjl$4sg$1@news.spamcop.net>

"Miss Betsy" <nobody@spamcop.net> wrote in message
news:ct841k$r3e$1@news.spamcop.net...
> Why Am I Blocked? Probable Causes
> If your email has suddenly been blocked by the SpamCop blocklist,
> it is probably because you share an IP address with other email
> users and there is someone who:

Way to grab that bull! <g>

Couple of things ... only posted in spamcop.help, when most
of (all) traffic has shifted over to the spamcop newsgroup ...
so thinking that a cross-post may have been more visible.
(as in e-mail, add both newsgroups into the same line)

Missing was a "page is found at .."  I/you could modify
the actual Pinned item to add this URL into the document
for the next time you copy/paste it here ... looks like some
formatting wouldn't hurt either to make it 'look' better
'here' ...


From nobody at devnull.spamcop.net  Wed Jan 26 11:41:01 2005
From: nobody at devnull.spamcop.net (Pop)
Date: Wed Jan 26 11:45:03 2005
Subject: [SC-Help] Re: Wrongly accused
References: <Xns95E8E243CF17Agjctcswxnsrt@216.154.195.61>
	<ct42do$q44$1@news.spamcop.net> <Xns95E9D1F415E7gjctcswxnsrt@216.154.195.61>
	<ct4ko6$9tk$1@news.spamcop.net> <Xns95E986003207gjctcswxnsrt@216.154.195.61>
	<ct5m13$vn4$1@news.spamcop.net> <Xns95E9B195E77B1gjctcswxnsrt@216.154.195.61>
	<Xns95E9BD8AF7780xnddmxn@216.154.195.61>
	<Xns95E9BBE4CABBFgjctcswxnsrt@216.154.195.61> <ct6b2h$hdm$1@news.spamcop.net>
	<Xns95E9E387CEACEgjctcswxnsrt@216.154.195.61> <ct6jbk$o9l$1@news.spamcop.net>
	<Xns95EA58EE64390gjctcswxnsrt@216.154.195.61> <ct7toi$mu3$1@news.spamcop.net>
	<Xns95EA806D55D95gjctcswxnsrt@216.154.195.61> <ct84eo$rg9$1@news.spamcop.net>
	<Xns95EA8C4272D10gjctcswxnsrt@216.154.195.61>
Message-ID: <ct8h6k$711$1@news.spamcop.net>

Geoff Lane wrote:
...
>
> I've wasted far too much time on this already. Spamcop just 
> isn't
> usable to us mere mortals, yet it can cause considerable damage 
> to
> innocent parties (and, for me, it has).

For quite a few posts, this thread was interesting and 
informative, but it's degenerated to a point of diminishing 
returns now in my view.  I'll probably stop following it at this 
point (I know, no loss, and it isn't) because I'm coming back 
around to my earlier opinion that the OP, thought it's not 
obvious, is a form of troller with a closed mind and only one 
goal in site.
   In sliding down through the thread from its beginning, the 
closed mind becomes more and more obvious:  Until spamcop people 
admit they are wrong and have wronged the entire world and aren't 
doing what they purport to do, this thread (or threads) will 
continue unabated.
   I find it absolutely amazing the number of sensible, very 
helpful, very clear and concise most of the time responses made, 
and every single responder deserves a KUDOS for their 
participation, but all this thread serves any longer is to extend 
its length.

There must be a zillion people using the Geoff Lane monicker; 
either that, or this guy's really prolific on about any subject 
you can think of, and always takes the negative side from what I 
see.  It's funny though, nearly every Geoff Lane search result I 
looked at sounded just like the Geoff Lane posting here.  And, 
some of the threads are pretty long.  It was an interesting trip, 
gotta admit that.  I think I liked the "Who do You Hate Today 
Geoff?" post the most, though it wasn't as obvious it was -this- 
Geoff Lane in that particular one.  I just liked the title.

Anyway, like I said, I think this thread has served its purpose 
for all but Geoff Lane; he seems to spend nearly all his time 
doing this same thing.  For grins, I searched for a John Smith 
and a Dave Jones,  and the results were more numerous, but not as 
well connected as the ones for Geoff Lane.

OK, I'll shut up now and I'm gone.  I know many will disagree 
with this, but I've spit out my two cents worth, adjusted for 
inflation.  I'll keep future opinions to myself on this subject.

Regards,

Pop

From MikeE at ster.invalid  Wed Jan 26 09:13:16 2005
From: MikeE at ster.invalid (Mike Easter)
Date: Wed Jan 26 12:15:02 2005
Subject: [SC-Help] Re: Wrongly accused
References: <Xns95E8E243CF17Agjctcswxnsrt@216.154.195.61>
	<ct42do$q44$1@news.spamcop.net> <Xns95E9D1F415E7gjctcswxnsrt@216.154.195.61>
	<ct4ko6$9tk$1@news.spamcop.net> <Xns95E986003207gjctcswxnsrt@216.154.195.61>
	<ct5m13$vn4$1@news.spamcop.net> <Xns95E9B195E77B1gjctcswxnsrt@216.154.195.61>
	<Xns95E9BD8AF7780xnddmxn@216.154.195.61>
	<Xns95E9BBE4CABBFgjctcswxnsrt@216.154.195.61> <ct6b2h$hdm$1@news.spamcop.net>
	<Xns95E9E387CEACEgjctcswxnsrt@216.154.195.61> <ct6jbk$o9l$1@news.spamcop.net>
	<Xns95EA58EE64390gjctcswxnsrt@216.154.195.61> <ct7toi$mu3$1@news.spamcop.net>
	<Xns95EA806D55D95gjctcswxnsrt@216.154.195.61> <ct84eo$rg9$1@news.spamcop.net>
	<Xns95EA8C4272D10gjctcswxnsrt@216.154.195.61> <ct8h6k$711$1@news.spamcop.net>
Message-ID: <ct8j35$8bj$1@news.spamcop.net>

Pop wrote:
> Until spamcop people
> admit they are wrong and have wronged the entire world and aren't
> doing what they purport to do, this thread (or threads) will
> continue unabated.

I went to the trouble to access the TBUDL mailing list archives, The-Bat
User Discussion List, since Geoff never did explain that to me, to see
the contents or body of the item for which the headers were posted -- 
actually a thread developed in the mailing list responses to his
question about differences between the older and newer Bat versions
store format and how he should/could handle that problem in the
evaluation of the newer version.

It would be very very 'stupid' or negligent for a spamcop reporter to
mistakenly report that item as spam.

It would also be very very stupid or incompetent for an abuse desk to
interpret that item's report as spam.

But, then, we never /did/ see a report link.  Maybe a deputy did or
figured it out without one.


-- 
Mike Easter
kibitzer, not SC admin

From nobody at spamcop.net  Wed Jan 26 14:35:28 2005
From: nobody at spamcop.net (Miss Betsy)
Date: Wed Jan 26 14:35:03 2005
Subject: [SC-Help] Re: If you have been blocked by SpamCop, please read
References: <ct841k$r3e$1@news.spamcop.net> <ct8fjl$4sg$1@news.spamcop.net>
Message-ID: <ct8r7q$erq$1@news.spamcop.net>


"WazoO" <nobody@devnull.spamcop.net> wrote in message
news:ct8fjl$4sg$1@news.spamcop.net...
> "Miss Betsy" <nobody@spamcop.net> wrote in message
> news:ct841k$r3e$1@news.spamcop.net...
> > Why Am I Blocked? Probable Causes
> > If your email has suddenly been blocked by the SpamCop
blocklist,
> > it is probably because you share an IP address with other email
> > users and there is someone who:
>
> Way to grab that bull! <g>
>
> Couple of things ... only posted in spamcop.help, when most
> of (all) traffic has shifted over to the spamcop newsgroup ...
> so thinking that a cross-post may have been more visible.
> (as in e-mail, add both newsgroups into the same line)
>
> Missing was a "page is found at .."  I/you could modify
> the actual Pinned item to add this URL into the document
> for the next time you copy/paste it here ... looks like some
> formatting wouldn't hurt either to make it 'look' better
> 'here' ...
>
>


From nobody at spamcop.net  Wed Jan 26 14:39:41 2005
From: nobody at spamcop.net (Miss Betsy)
Date: Wed Jan 26 14:40:02 2005
Subject: [SC-Help] Re: If you have been blocked by SpamCop, please read
References: <ct841k$r3e$1@news.spamcop.net> <ct8fjl$4sg$1@news.spamcop.net>
Message-ID: <ct8rfl$f5j$1@news.spamcop.net>


"WazoO" <nobody@devnull.spamcop.net> wrote in message
news:ct8fjl$4sg$1@news.spamcop.net...
<snip>
> Couple of things ... only posted in spamcop.help, when most
> of (all) traffic has shifted over to the spamcop newsgroup ...
> so thinking that a cross-post may have been more visible.
> (as in e-mail, add both newsgroups into the same line)

I realized that when I went to check online that spamcop.help is
not listed.  I didn't do the main group because the discussion was
here.

>
> Missing was a "page is found at .."  I/you could modify
> the actual Pinned item to add this URL into the document
> for the next time you copy/paste it here ... looks like some
> formatting wouldn't hurt either to make it 'look' better
> 'here' ...

I figured it was better than nothing!  I will see about formatting
before I post in spamcop.  Not quite sure what was missing?  The
URL of the Why Am I Blocked FAQ?  Maybe I will find it when I do
some formatting.

Miss Betsy


From wb8tyw at qsl.network  Wed Jan 26 14:01:37 2005
From: wb8tyw at qsl.network (John E. Malmberg)
Date: Wed Jan 26 15:05:04 2005
Subject: [SC-Help] Re: If you have been blocked by SpamCop, please read
References: <ct841k$r3e$1@news.spamcop.net>
Message-ID: <s19srWK3yteU@eisner.encompasserve.org>

In article <ct841k$r3e$1@news.spamcop.net>,
  "Miss Betsy" <nobody@spamcop.net> writes:
> Why Am I Blocked? Probable Causes
> If your email has suddenly been blocked by the SpamCop blocklist,
> it is probably because you share an IP address with other email
> users and there is someone who:
>
>     * is using auto-responses that are replying to spam with forged
> spamtrap email
>       addresses (such as Out-of-Office/Vacation notices, virus
> notifications, and 'created email' bounces);

      * Has installed the lasted fad anti-spam product that can be
        downloaded from the internet, and it turns out that this
        product abusively floods the abuse desks of ISP's that had
        nothing to do with spam/virus.
      ** Usually also means that the mail server is also accepting
        e-mail from sources previously identified to only send spam,
        so is letting users get spam to do something stupid with.

      * has a home made spam automatic spam detecting and reporting
        system that is sending all suspected spam to spamcop.net
        and blindly confirming all of it, and as a result of it
        not working perfectly has ended up reporting their own mail
	server as a spam source for a significant amount of spam.
        [Generally seen only on small to mid scale mail servers,
        and only a few times a year]
      ** Usually also means that the mail server is also accepting
        e-mail from sources previously identified to only send spam,
        so is letting users get spam to do something stupid with.

      * Your provider has a web mailer that allows automated signups
        from known open proxies and will also accept email from known
        open proxies.  Basically that means that your ISP's mail servers
        are spending most of their time sending advance fee scams.
[big snip]

>     * the SMTP/Auth exploit of an Exchange server is in progress,

      * the SMTP/Auth exploit of a mail server is in progress.
        While commonly seen on Exchange servers, this condition is
        possible on all platforms
[small snip]

      * Your PHP mailer program has been taken over by criminals.
      ** You did not know that your PHP bulletin board had a very
         vulnerable mailer program on it?
      *** You did not know that you had PHP?

      * Your web mail service allows sending of e-mail from known
        open proxies and suspected compromised computers.
      ** Your web mail service allows signups from known open proxies
        and suspected compromised computers.
      ** Your web mail server allows new users to send unlmited
         amounts of e-mail, especially users who you do not know if
         you can collect damages from them for abuse.
      *** Your free web mail server allows forged sending names.
      *** Your free web mail server allows replies to the e-mail be
          sent to a different e-mail provider.

	The more of these characteristics match your web mail service,
	the more Advance Fee Scammers and Nigerian 419 scammers will
	flock to it.


>
> The rest of this FAQ is for people who do not run servers. Post the
> IP address that is blocked in the Spamcop web forum or newsgroup.
>
> Q: What is a blocklist? A: A blocklist helps ISP’s to prevent spam
> coming to their customers.
> An ISP can use a blocklist (a list of IP addresses),to block
> (bounce back) all email coming from a particular IP address.
------^ * BAD WORD * -----

  (Reject) all mail coming from a particular IP address.  This rejection
  will cause your ISP to send you what is called a "bounce" message.

>
> Q: What is SpamCop? A: Unique, automated blocklist and spam
> filtering
> SpamCop has a program that will find the correct address to send a
  Spamcop has a program that will try to find the correct address to send a

> complaint because the email address you see that says who it is

  from is often forged by spammers. SpamCop uses the information in
  public internet databases that ISPs are supposed to put the correct
  information in to find the proper
> address and forwards complaints for its members. If a lot of
> reports are made, the IP address goes on the SpamCop blocklist that
> is used by many ISP’s. for more detailed information on how Spamcop
> works see: http://www.spamcop.net/fom-serve/cache/3.html


> Q: How do ISP's use SpamCop A: As 1) a warning that spammers have
> slipped by their defenses and 2) to block spam.
> 1) Responsible ISP's welcome SpamCop reports and will remove
> spammers quickly from their systems.

  A spamcop.net report usually means that a criminal is using an unsecured
  system on the ISP's network to steal bandwidth from that ISP.  In addition
  the spammer is likely overloading a section of the ISP's network so that
  their paying customers are having problems accessing the internet, and
  the ISP is having to issue refunds in addition to losing money on the
  bandwidth stolen.

  An ISP that allows compromised machines on it's network is hurting both
  their profits and their customer's internet access.

  2a)Spamcop.net is aggressive and is likely to list real mail servers
  on occasion, so an ISP's spam filter can use the spamcop.net listing
  as part of determining if an e-mail is spam or not.

  2b)A mail server can choose to tag spam or put it into a user's spam
  folder instead of blocking the mail.  Doing so increases the risk that
  a real message that was misclassified as spam will be deleted with out
  either the sender or the receiver knowing about it until a long time
  has passed.  It also increases the cost of operating the mail server.

  It also increases the chance that their users will do something stupid
  with the spam to abuse other networks.

  Unfortunately history has shown that there are a significant number
  of mail server operators that will only fix a security problem when
  their own users start complaining that their mails are bouncing, even
  though it is likely that the security problem is costing them enough
  money that they should have noticed it even with out the spam reports
  or the users complaining.

> 2c)When they block emails, they send a message that looks like this:
  ------------ Incorrect --------------

  When they block emails, they give a code and a short text message to
  your mail server, and your mail server returns your mail with a message
  that looks like:

> 451 Blocked - see
  551 blocked - see
> http://www.spamcop.net/bl.shtml?xxxx.xxxx.xxxx.xxxx:
> or
> email from xxx.com blocked,refused by Spamcop,see
> http://www.spamcop.net


> Q: Why me? A: It Happens to the best of us
> It is annoying to have your email blocked. It is also annoying to
> have a backhoe interrupt email service.

  Which would you rather have, your ISP sending you a bounce messages
  because other ISP's are getting spam from them, or having the other
  ISP's or users having spam filters that just silently delete all
  email coming from your ISP?

  Most of the commercial spam filtering available just silently deletes
  suspected spam from incoming email.  Neither the sender or the receiver
  is notifed.

> See this link for a longer explanation of costs
> http://forum.spamcop.net/forums/index.php?showtopic=660
>
From geoff at nospam.gjctech.co.uk  Wed Jan 26 20:22:20 2005
From: geoff at nospam.gjctech.co.uk (Geoff Lane)
Date: Wed Jan 26 15:25:03 2005
Subject: [SC-Help] Re: Wrongly accused
References: <Xns95E8E243CF17Agjctcswxnsrt@216.154.195.61>
	<ct42do$q44$1@news.spamcop.net> <Xns95E9D1F415E7gjctcswxnsrt@216.154.195.61>
	<ct4ko6$9tk$1@news.spamcop.net> <Xns95E986003207gjctcswxnsrt@216.154.195.61>
	<ct5m13$vn4$1@news.spamcop.net> <Xns95E9B195E77B1gjctcswxnsrt@216.154.195.61>
	<Xns95E9BD8AF7780xnddmxn@216.154.195.61>
	<Xns95E9BBE4CABBFgjctcswxnsrt@216.154.195.61> <ct6b2h$hdm$1@news.spamcop.net>
	<Xns95E9E387CEACEgjctcswxnsrt@216.154.195.61> <ct6jbk$o9l$1@news.spamcop.net>
	<Xns95EA58EE64390gjctcswxnsrt@216.154.195.61> <ct7toi$mu3$1@news.spamcop.net>
	<Xns95EA806D55D95gjctcswxnsrt@216.154.195.61> <ct84eo$rg9$1@news.spamcop.net>
	<Xns95EA8C4272D10gjctcswxnsrt@216.154.195.61> <ct8h6k$711$1@news.spamcop.net>
Message-ID: <Xns95EACFFD0277Agjctcswxnsrt@216.154.195.61>

"Pop" <nobody@devnull.spamcop.net> wrote in news:ct8h6k$711$1
@news.spamcop.net:

> Anyway, like I said, I think this thread has served its purpose 
> for all but Geoff Lane; he seems to spend nearly all his time 
> doing this same thing.  For grins, I searched for a John Smith 
> and a Dave Jones,  and the results were more numerous, but not as 
> well connected as the ones for Geoff Lane.

Actually, this thread has served its original purpose for this Geoff 
Lane. My original purpose in posting to this forum was simply to ask how 
I could report the person who made the false report. I quoted the 
"offending message" to help others provide the advice I sought.

Secondly, as this incident has cost me personally nearly five hundred 
dollars, I thought it may serve as a reminder to some SC users as to why 
they need to take care that their reports are warranted (something that I 
doubt the reporter in my case had done).

I was astonished at the response I got back. Far from just saying, "Go to 
such and such page and fill in the form", or "email the deputies", 
everyone seemed to be jumping onto the defensive and saying "we are 
blameless, go take it up with your ISP." FWIW, it was actually that 
reaction that got me diving "under the hood". Those responses changed my 
perception of Spamcop and I began to question the morality of what 
Spamcop is doing. Gentlemen, you led me down this path - not the other 
way round.

For anyone that's interested, I still believe that SC's reason detré is 
basically good. However, the process used is likely to result in 
significant collateral damage. Personally, I believe that a review is 
warranted and that the amount of collateral damage can be reduced without 
too much cost to SC. But, hey, that's only my opinion.

-- 
Geoff Lane
Cornwall, UK
From nobody at spamcop.net  Wed Jan 26 16:44:03 2005
From: nobody at spamcop.net (Miss Betsy)
Date: Wed Jan 26 16:45:03 2005
Subject: [SC-Help] Re: Wrongly accused
References: <Xns95E8E243CF17Agjctcswxnsrt@216.154.195.61>
	<ct42do$q44$1@news.spamcop.net> <Xns95E9D1F415E7gjctcswxnsrt@216.154.195.61>
	<ct4ko6$9tk$1@news.spamcop.net> <Xns95E986003207gjctcswxnsrt@216.154.195.61>
	<ct5m13$vn4$1@news.spamcop.net> <Xns95E9B195E77B1gjctcswxnsrt@216.154.195.61>
	<Xns95E9BD8AF7780xnddmxn@216.154.195.61>
	<Xns95E9BBE4CABBFgjctcswxnsrt@216.154.195.61> <ct6b2h$hdm$1@news.spamcop.net>
	<Xns95E9E387CEACEgjctcswxnsrt@216.154.195.61> <ct6jbk$o9l$1@news.spamcop.net>
	<Xns95EA58EE64390gjctcswxnsrt@216.154.195.61> <ct7toi$mu3$1@news.spamcop.net>
	<Xns95EA806D55D95gjctcswxnsrt@216.154.195.61> <ct84eo$rg9$1@news.spamcop.net>
	<Xns95EA8C4272D10gjctcswxnsrt@216.154.195.61> <ct8h6k$711$1@news.spamcop.net>
	<Xns95EACFFD0277Agjctcswxnsrt@216.154.195.61>
Message-ID: <ct92oq$m50$1@news.spamcop.net>

<snip>
> I was astonished at the response I got back. Far from just
saying, "Go to
> such and such page and fill in the form", or "email the
deputies",
> everyone seemed to be jumping onto the defensive and saying "we
are
> blameless, go take it up with your ISP." FWIW, it was actually
that
> reaction that got me diving "under the hood". Those responses
changed my
> perception of Spamcop and I began to question the morality of
what
> Spamcop is doing. Gentlemen, you led me down this path - not the
other
> way round.
>
> For anyone that's interested, I still believe that SC's reason
detré is
> basically good. However, the process used is likely to result in
> significant collateral damage. Personally, I believe that a
review is
> warranted and that the amount of collateral damage can be reduced
without
> too much cost to SC. But, hey, that's only my opinion.

I am sorry that you have lost money due to this particular problem.
I don't know why it is not easier to challenge a report other than
the spamcop admin feel that they have provided a way through the
possibility of replying to the report id (the reporter) and that
the ISP who receives the report has a way to question the report.
It is only when the receiving ISP does not do what he is supposed
to do, that problems such as yours arise and Julian does not have
much patience with those who don't do what they are supposed to do.

And that is why that everyone has told you to make the biggest
noise to your provider, not spamcop.  You pay them to provide you
service and they have not done so.

Miss Betsy





From nobody at devnull.spamcop.net  Wed Jan 26 16:17:47 2005
From: nobody at devnull.spamcop.net (Cat)
Date: Wed Jan 26 17:20:03 2005
Subject: [SC-Help] Re: Wrongly accused
In-Reply-To: <Xns95EA5A016B51Cgjctcswxnsrt@216.154.195.61>
References: <Xns95E8E243CF17Agjctcswxnsrt@216.154.195.61>
	<ct42do$q44$1@news.spamcop.net> <Xns95E9D1F415E7gjctcswxnsrt@216.154.195.61>
	<ct4ko6$9tk$1@news.spamcop.net> <Xns95E986003207gjctcswxnsrt@216.154.195.61>
	<ct6hh1$msq$1@news.spamcop.net> <Xns95EA5A016B51Cgjctcswxnsrt@216.154.195.61>
Message-ID: <ct94ua$nil$1@news.spamcop.net>

Geoff Lane wrote:

<snip>

> Let's get one thing absolutely straight here. At the head of this
> thread, I wrote, "Although most of the problem was due to my ISP
> (PlusNet) not acting reasonably and professionally, the whole thing was
> started by a Spamcop user reporting as spam a post that I made to a
> mailing list to which he had explicitly subscribed. I'm relating this
> tale here to urge fellow users to take care when making those spam
> reports..." 
> 
> Of course the ISP should investigate complaints properly. However, that 
> doesn't absolve Spamcop or its users from a moral obligation to ensure that 
> complaints are justified. I've given reasons for my opinion on this in 
> another branch of this thread.

Like others have said, SpamCop has methods by which you can dispute 
false complaints filed by SpamCop users. I understand that you would 
want to post this to make sure that SpamCop's users are more careful, 
but your own comments in different posts in this thread suggest that you 
are still blaming SpamCop for your ISP's irresponsible behavior. SpamCop 
did not force your ISP to take any action against you without 
investigation.

I read the "I have been falsely and/or maliciously accused of spamming, 
what can I do?" link in the SpamCop FAQ, and I do agree that it should 
be worded more clearly with an address at SpamCop where you can notify 
SpamCop's admin and deputies that someone submitted a false report. I 
don't know whether you would notify SpamCop directly or through the 
deputy e-mail address, which is deputies@admin.spamcop.net. I see from 
that FAQ that there is a method for disputing a BL listing, but in this 
case, you're disputing a single complaint and not a BL listing.
From nobody at devnull.spamcop.net  Wed Jan 26 16:39:23 2005
From: nobody at devnull.spamcop.net (Cat)
Date: Wed Jan 26 17:40:03 2005
Subject: [SC-Help] Re: Wrongly accused
In-Reply-To: <Xns95EACFFD0277Agjctcswxnsrt@216.154.195.61>
References: <Xns95E8E243CF17Agjctcswxnsrt@216.154.195.61>
	<ct42do$q44$1@news.spamcop.net> <Xns95E9D1F415E7gjctcswxnsrt@216.154.195.61>
	<ct4ko6$9tk$1@news.spamcop.net> <Xns95E986003207gjctcswxnsrt@216.154.195.61>
	<ct5m13$vn4$1@news.spamcop.net> <Xns95E9B195E77B1gjctcswxnsrt@216.154.195.61>
	<Xns95E9BD8AF7780xnddmxn@216.154.195.61>
	<Xns95E9BBE4CABBFgjctcswxnsrt@216.154.195.61> <ct6b2h$hdm$1@news.spamcop.net>
	<Xns95E9E387CEACEgjctcswxnsrt@216.154.195.61> <ct6jbk$o9l$1@news.spamcop.net>
	<Xns95EA58EE64390gjctcswxnsrt@216.154.195.61> <ct7toi$mu3$1@news.spamcop.net>
	<Xns95EA806D55D95gjctcswxnsrt@216.154.195.61> <ct84eo$rg9$1@news.spamcop.net>
	<Xns95EA8C4272D10gjctcswxnsrt@216.154.195.61> <ct8h6k$711$1@news.spamcop.net>
	<Xns95EACFFD0277Agjctcswxnsrt@216.154.195.61>
Message-ID: <ct966q$oc2$1@news.spamcop.net>

Geoff Lane wrote:

<snip>

> I was astonished at the response I got back. Far from just saying, "Go to 
> such and such page and fill in the form", or "email the deputies", 
> everyone seemed to be jumping onto the defensive and saying "we are 
> blameless, go take it up with your ISP." FWIW, it was actually that 
> reaction that got me diving "under the hood". Those responses changed my 
> perception of Spamcop and I began to question the morality of what 
> Spamcop is doing. Gentlemen, you led me down this path - not the other 
> way round.

Well, since Miss Betsy and I both replied to you in this thread, not 
everyone who replied to attempt to help you understand this issue is a 
gentleman. Some of us are ladies.

Several replies in the thread pointed out to you that there are methods 
for disputing false complaints, which would lead to SpamCop suspending 
the account of whoever filed the false complaint. That still doesn't 
change the fact that your ISP behaved irresponsibly. I don't understand 
why you continue to blame SpamCop when all this could have been avoided 
if your ISP's abuse admin had only done his/her job correctly instead of 
blindly accepting a SpamCop complaint as definite proof of spamming 
activity.
From nobody at spamcop.net  Wed Jan 26 19:09:47 2005
From: nobody at spamcop.net (Miss Betsy)
Date: Wed Jan 26 19:10:05 2005
Subject: [SC-Help] Re: Wrongly accused
References: <Xns95E8E243CF17Agjctcswxnsrt@216.154.195.61>
	<ct42do$q44$1@news.spamcop.net> <Xns95E9D1F415E7gjctcswxnsrt@216.154.195.61>
	<ct4ko6$9tk$1@news.spamcop.net> <Xns95E986003207gjctcswxnsrt@216.154.195.61>
	<ct5m13$vn4$1@news.spamcop.net> <Xns95E9B195E77B1gjctcswxnsrt@216.154.195.61>
	<Xns95E9BD8AF7780xnddmxn@216.154.195.61>
	<Xns95E9BBE4CABBFgjctcswxnsrt@216.154.195.61> <ct6b2h$hdm$1@news.spamcop.net>
	<Xns95E9E387CEACEgjctcswxnsrt@216.154.195.61> <ct6jbk$o9l$1@news.spamcop.net>
	<Xns95EA58EE64390gjctcswxnsrt@216.154.195.61> <ct7toi$mu3$1@news.spamcop.net>
	<Xns95EA806D55D95gjctcswxnsrt@216.154.195.61> <ct84eo$rg9$1@news.spamcop.net>
	<Xns95EA8C4272D10gjctcswxnsrt@216.154.195.61> <ct8h6k$711$1@news.spamcop.net>
	<Xns95EACFFD0277Agjctcswxnsrt@216.154.195.61> <ct966q$oc2$1@news.spamcop.net>
Message-ID: <ct9ba2$spg$1@news.spamcop.net>


"Cat" <nobody@devnull.spamcop.net> wrote in message
news:ct966q$oc2$1@news.spamcop.net...
> Geoff Lane wrote:
>> Gentlemen, you led me down this path - not the other
> > way round.
>
> Well, since Miss Betsy and I both replied to you in this thread,
not
> everyone who replied to attempt to help you understand this issue
is a
> gentleman. Some of us are ladies.

I am glad you pointed that out!  Since he didn't bother to respond
to my first post, I didn't think he was reading my posts and
decided just to post a rebuttal for the benefit of a newcomer who
was reading the thread.

Miss Betsy


From nobody at devnull.spamcop.net  Wed Jan 26 19:10:21 2005
From: nobody at devnull.spamcop.net (Pop)
Date: Wed Jan 26 19:15:03 2005
Subject: [SC-Help] Re: Wrongly accused
References: <Xns95E8E243CF17Agjctcswxnsrt@216.154.195.61>
	<ct42do$q44$1@news.spamcop.net> <Xns95E9D1F415E7gjctcswxnsrt@216.154.195.61>
	<ct4ko6$9tk$1@news.spamcop.net> <Xns95E986003207gjctcswxnsrt@216.154.195.61>
	<ct5m13$vn4$1@news.spamcop.net> <Xns95E9B195E77B1gjctcswxnsrt@216.154.195.61>
	<Xns95E9BD8AF7780xnddmxn@216.154.195.61>
	<Xns95E9BBE4CABBFgjctcswxnsrt@216.154.195.61> <ct6b2h$hdm$1@news.spamcop.net>
	<Xns95E9E387CEACEgjctcswxnsrt@216.154.195.61> <ct6jbk$o9l$1@news.spamcop.net>
	<Xns95EA58EE64390gjctcswxnsrt@216.154.195.61> <ct7toi$mu3$1@news.spamcop.net>
	<Xns95EA806D55D95gjctcswxnsrt@216.154.195.61> <ct84eo$rg9$1@news.spamcop.net>
	<Xns95EA8C4272D10gjctcswxnsrt@216.154.195.61> <ct8h6k$711$1@news.spamcop.net>
	<ct8j35$8bj$1@news.spamcop.net>
Message-ID: <ct9bh4$tc1$1@news.spamcop.net>

Mike Easter wrote:
> Pop wrote:
>> Until spamcop people
>> admit they are wrong and have wronged the entire world and 
>> aren't
>> doing what they purport to do, this thread (or threads) will
>> continue unabated.
>
> I went to the trouble to access the TBUDL mailing list 
> archives,
> The-Bat User Discussion List, since Geoff never did explain 
> that to
...

Mike E.,

You do know what you quoted wasn't addressed at you, right?  IMO 
the surrounding text to the quoted text here kept it pretty 
plainly in context of being a GL attitude.  Just curious; maybe 
I'm misinterpreting now.

I won't be following this thread anymore since it's pretty much 
shot, so if you care about my seeing your response, you'll have 
to use a different thread.  Not that I'm requesting or expecting 
a response - just wanted to be sure things were straight, not to 
elicit any specific response.

Regards,

Pop

From geoff at nospam.gjctech.co.uk  Thu Jan 27 00:13:10 2005
From: geoff at nospam.gjctech.co.uk (Geoff Lane)
Date: Wed Jan 26 19:15:10 2005
Subject: [SC-Help] Re: Wrongly accused
References: <Xns95E8E243CF17Agjctcswxnsrt@216.154.195.61>
	<ct42do$q44$1@news.spamcop.net> <Xns95E9D1F415E7gjctcswxnsrt@216.154.195.61>
	<ct4ko6$9tk$1@news.spamcop.net> <Xns95E986003207gjctcswxnsrt@216.154.195.61>
	<ct5m13$vn4$1@news.spamcop.net> <Xns95E9B195E77B1gjctcswxnsrt@216.154.195.61>
	<Xns95E9BD8AF7780xnddmxn@216.154.195.61>
	<Xns95E9BBE4CABBFgjctcswxnsrt@216.154.195.61> <ct6b2h$hdm$1@news.spamcop.net>
	<Xns95E9E387CEACEgjctcswxnsrt@216.154.195.61> <ct6jbk$o9l$1@news.spamcop.net>
	<Xns95EA58EE64390gjctcswxnsrt@216.154.195.61> <ct7toi$mu3$1@news.spamcop.net>
	<Xns95EA806D55D95gjctcswxnsrt@216.154.195.61> <ct84eo$rg9$1@news.spamcop.net>
	<Xns95EA8C4272D10gjctcswxnsrt@216.154.195.61> <ct8h6k$711$1@news.spamcop.net>
	<Xns95EACFFD0277Agjctcswxnsrt@216.154.195.61> <ct966q$oc2$1@news.spamcop.net>
Message-ID: <Xns95EB2FB25B5Fgjctcswxnsrt@216.154.195.61>

Cat <nobody@devnull.spamcop.net> wrote in
news:ct966q$oc2$1@news.spamcop.net: 

> Well, since Miss Betsy and I both replied to you in this thread, not 
> everyone who replied to attempt to help you understand this issue is a
> gentleman. Some of us are ladies.
---
My apologies. However, although I now suspect it isn't politically
correct where you are, where I live, "gentemen" means "gathering of
esteemed colleagues" in the contex I used. Perhaps I've been watching
too many films, but I've also heard that used in the same way in the
portrayal of US military. 

> 
> Several replies in the thread pointed out to you that there are
> methods for disputing false complaints, which would lead to SpamCop
> suspending the account of whoever filed the false complaint. That
> still doesn't change the fact that your ISP behaved irresponsibly. I
> don't understand why you continue to blame SpamCop when all this could
> have been avoided if your ISP's abuse admin had only done his/her job
> correctly instead of blindly accepting a SpamCop complaint as definite
> proof of spamming activity.
---
I am not blaming Spamcop for the shortcomings of my ISP, who I hold far 
more culpable in this than I hold Spamcop. 

There are two distinct issues here:
1. The ISP's obligations to use due diligence and to discharge his duty
   of care towards his customer.
2. Spamcop's obligations to use due diligence and care to avoid making
   false accusations.

Now I'm not disputing the first in any way -- of course the ISP has a 
duty of care. Certainly, the way that my ISP acted was reprehensible, and 
I've taken them to task over that.

In a way this is similar to a tyre shop and a motorist. The tyre shop 
supplies a defective tyre and the motorist gets prosecuted for driving on 
it. Sure, the motorist should check his tyres before every journey, 
including the one when leaving the garage - but that does not absolve the 
tyre shop of their responsibility to provide safe tyres fit for purpose. 
Spamcop is like the tyre shop and the ISP like the motorist. An ISP's 
failure to check Spamcop's spam reports doesn't absolve Spamcop from an 
obligation to ensure that those reports are fit for purpose. I'm 
questioning whether Spamcop has done enough to meet that obligation. 
Spamcop (and its users) make mistakes which I feel SC should be doing 
more to limit - full stop.

Because its allegations have effects over which neither the alleged 
spammer nor the alleged spammer's ISP have control, Spamcop has (IMO) a 
duty of care to limit the likelihood of false accusations. To that end, 
there is a feedback system in place (which, thanks to this thread, I've 
used; and I've received notice that action has been taken against my 
reporter). That said, the system is not instinctive and I feel it could 
be improved by being made more explict and prominent. I also feel that a 
more proactive approach should be made towards report quality - perhaps 
inspection of a random sample.

I also feel that Spamcop also has a moral duty to provide the means for 
the convicted to know of what he is accused. That means he needs to be 
able to access the reports being used in evidence against him. Right now, 
if someone accuses me of spamming I cannot see what it is that I'm 
supposed to have sent. The nature of the spam gives essential clues as to 
the cause, be it that I'm personally spamming, I have malware running on 
my computer, I have an open relay, or the reports are unwarranted. To 
that end, I suggest making reports available to requests from an IP 
address that features in the headers of the alleged spam. That would go a 
long way towards helping those with fixed IP addresses to resolve their 
problems.

Now I understand the point of view expressed in this thread that it is 
the ISP's responsibility to make those reports available. However, the 
ISP isn't responsible for sending those reports - Spamcop is. It is 
Spamcop, not the ISP that is accusing the alleged spammer of wrongdoing, 
and thus it is Spamcop, not the ISP, that is morally obliged to 
substantiate it's accusations with evidence when required by the person 
they are accusing. This is a basic tenet of every legal system that is 
not morally corrupt.

-- 
Geoff Lane
Cornwall, UK
From nobody at devnull.spamcop.net  Wed Jan 26 18:34:20 2005
From: nobody at devnull.spamcop.net (WazoO)
Date: Wed Jan 26 19:35:04 2005
Subject: [SC-Help] Re: Wrongly accused
References: <Xns95E8E243CF17Agjctcswxnsrt@216.154.195.61>
	<ct42do$q44$1@news.spamcop.net> <Xns95E9D1F415E7gjctcswxnsrt@216.154.195.61>
	<ct4ko6$9tk$1@news.spamcop.net> <Xns95E986003207gjctcswxnsrt@216.154.195.61>
	<ct5m13$vn4$1@news.spamcop.net> <Xns95E9B195E77B1gjctcswxnsrt@216.154.195.61>
	<Xns95E9BD8AF7780xnddmxn@216.154.195.61>
	<Xns95E9BBE4CABBFgjctcswxnsrt@216.154.195.61> <ct6b2h$hdm$1@news.spamcop.net>
	<Xns95E9E387CEACEgjctcswxnsrt@216.154.195.61> <ct6jbk$o9l$1@news.spamcop.net>
	<Xns95EA58EE64390gjctcswxnsrt@216.154.195.61> <ct7toi$mu3$1@news.spamcop.net>
	<Xns95EA806D55D95gjctcswxnsrt@216.154.195.61> <ct84eo$rg9$1@news.spamcop.net>
	<Xns95EA8C4272D10gjctcswxnsrt@216.154.195.61> <ct8h6k$711$1@news.spamcop.net>
	<Xns95EACFFD0277Agjctcswxnsrt@216.154.195.61> <ct966q$oc2$1@news.spamcop.net>
	<Xns95EB2FB25B5Fgjctcswxnsrt@216.154.195.61>
Message-ID: <ct9cud$u93$1@news.spamcop.net>

"Geoff Lane" <geoff@nospam.gjctech.co.uk> wrote in message
news:Xns95EB2FB25B5Fgjctcswxnsrt@216.154.195.61...
>
> My apologies. However, although I now suspect it isn't politically
> correct where you are, where I live, "gentemen" means "gathering of
> esteemed colleagues" in the contex I used. Perhaps I've been watching
> too many films, but I've also heard that used in the same way in the
> portrayal of US military.

 Retired U.S.Army here ... reality and film portrayals rarely natch.

> In a way this is similar to a tyre shop and a motorist. The tyre shop
> supplies a defective tyre and the motorist gets prosecuted for driving on
> it. Sure, the motorist should check his tyres before every journey,
> including the one when leaving the garage - but that does not absolve the
> tyre shop of their responsibility to provide safe tyres fit for purpose.
> Spamcop is like the tyre shop and the ISP like the motorist.

 The Forum FAQ includes an entry that suggests the analogy of
a Credit Reporting Agency.  To use your analogy, I'd rather
state that SpamCop is nothing more than the "tyre changing
machine" ... a "tool" that just sets there doing nothing until
someone decised to turn it on and apply its benefits to the job
at hand.  As a "tyre changing tool" it excels.  When used to
open the next bottle of lager, it sucks.

> Because its allegations have effects over which neither the alleged
> spammer nor the alleged spammer's ISP have control,

 A report of an incident is not an "allegation" of wrong-doing ...
it's just a notification ...

> Spamcop has (IMO) a
> duty of care to limit the likelihood of false accusations. To that end,
> there is a feedback system in place (which, thanks to this thread, I've
> used; and I've received notice that action has been taken against my
> reporter). That said, the system is not instinctive and I feel it could
> be improved by being made more explict and prominent. I also feel that a
> more proactive approach should be made towards report quality - perhaps
> inspection of a random sample.

Yep, easy to say, yet ... take a second or two and paint in the
rest of the picture.  Can you say "spammers make everything they
touch suck" or something anywhere close?  Sure, an address could
be placed on the front page, flashing in a neon green, such that
no one could miss it.  Exactly how long would you suppose that
this prominently displayed address would be of any value .. to
anyone?

> I also feel that Spamcop also has a moral duty to provide the means for
> the convicted to know of what he is accused. That means he needs to be
> able to access the reports being used in evidence against him.

It used to be such.  Can you once again say "spammers make everything
they touch suck" or something along those lines?

> Now I understand the point of view expressed in this thread that it is
> the ISP's responsibility to make those reports available. However, the
> ISP isn't responsible for sending those reports - Spamcop is.

The SpamCop user is responsible.  Again, the SpamCop parsing and
reporting tool is just a tool.


From David1 at suescornerweb.com  Wed Jan 26 20:59:08 2005
From: David1 at suescornerweb.com (David 1)
Date: Wed Jan 26 21:00:03 2005
Subject: [SC-Help] Re: If you have been blocked by SpamCop, please read
In-Reply-To: <responseguard-562E4D.10504826012005@news.cesmail.net>
References: <ct841k$r3e$1@news.spamcop.net>
	<responseguard-562E4D.10504826012005@news.cesmail.net>
Message-ID: <ct9ht0$24h$1@news.spamcop.net>

Bob W. wrote:
> In article <ct841k$r3e$1@news.spamcop.net>,
>  "Miss Betsy" <nobody@spamcop.net> wrote:
> 
> 
>>Why Am I Blocked? Probable Causes
> 
> 
> Nsip>
> 
>>Revised 18 Nov 2004 - Wazoo added DNSBL List URL
>>Revised 16 Nov 2004 - Wazoo - Ouch! newsgroup link fixed!
>>Revised 2 Sep 2004 - Wazoo
>>Revised August 7, 2004 - Miss Betsy, Wazoo, dbiel
>>Edited per Wazoo comments March 6, 2004 rev March 7 rev Mar 8 for
>>format (agsteele) Rev Mar11 with more links Rev Mar 12 with new
>>John link rev 13 listized "Probable Causes" rev 14 consolidated
>>some links
>>Contributors: Michaell, Mike Easter, Wazoo, Greenlady, John, JT,
>>JeffG
> 
> 
> Great work, folks!
> 

agreed.

-- 

David 1
bad addy
spamtrap@suescornerweb.com
From MikeE at ster.invalid  Wed Jan 26 18:19:15 2005
From: MikeE at ster.invalid (Mike Easter)
Date: Wed Jan 26 21:20:03 2005
Subject: [SC-Help] Re: Wrongly accused
References: <Xns95E8E243CF17Agjctcswxnsrt@216.154.195.61>
	<ct42do$q44$1@news.spamcop.net> <Xns95E9D1F415E7gjctcswxnsrt@216.154.195.61>
	<ct4ko6$9tk$1@news.spamcop.net> <Xns95E986003207gjctcswxnsrt@216.154.195.61>
	<ct5m13$vn4$1@news.spamcop.net> <Xns95E9B195E77B1gjctcswxnsrt@216.154.195.61>
	<Xns95E9BD8AF7780xnddmxn@216.154.195.61>
	<Xns95E9BBE4CABBFgjctcswxnsrt@216.154.195.61> <ct6b2h$hdm$1@news.spamcop.net>
	<Xns95E9E387CEACEgjctcswxnsrt@216.154.195.61> <ct6jbk$o9l$1@news.spamcop.net>
	<Xns95EA58EE64390gjctcswxnsrt@216.154.195.61> <ct7toi$mu3$1@news.spamcop.net>
	<Xns95EA806D55D95gjctcswxnsrt@216.154.195.61> <ct84eo$rg9$1@news.spamcop.net>
	<Xns95EA8C4272D10gjctcswxnsrt@216.154.195.61> <ct8h6k$711$1@news.spamcop.net>
	<ct8j35$8bj$1@news.spamcop.net> <ct9bh4$tc1$1@news.spamcop.net>
Message-ID: <ct9j2q$3sl$1@news.spamcop.net>

Pop wrote:
> Mike Easter wrote:
>> Pop wrote:
>>> Until spamcop people
>>> admit they are wrong and have wronged the entire world and
>>> aren't
>>> doing what they purport to do, this thread (or threads) will
>>> continue unabated.
>>
>> I went to the trouble to access the TBUDL mailing list
>> archives,
>> The-Bat User Discussion List, since Geoff never did explain
>> that to
> ...
>
> Mike E.,
>
> You do know what you quoted wasn't addressed at you, right?

Yes.

>  IMO
> the surrounding text to the quoted text here kept it pretty
> plainly in context of being a GL attitude.  Just curious; maybe
> I'm misinterpreting now.

Yes.  I understand.

I was citing your post as if you were speaking for Geoff's 'position' -- 
with which you did not agree and were taking to task.  But, then I was
further elaborating on some issues involved which I hadn't brought out
earlier.

> I won't be following this thread anymore since it's pretty much
> shot, so if you care about my seeing your response, you'll have
> to use a different thread.  Not that I'm requesting or expecting
> a response - just wanted to be sure things were straight, not to
> elicit any specific response.

Whether you follow it or not, I'm addressing your remark.

-- 
Mike Easter
kibitzer, not SC admin

From driehuis.fcnzpbc2005 at playbeing.com  Thu Jan 27 04:10:07 2005
From: driehuis.fcnzpbc2005 at playbeing.com (Bert Driehuis)
Date: Wed Jan 26 22:15:04 2005
Subject: [SC-Help] Re: Wrongly accused
In-Reply-To: <Xns95EA806D55D95gjctcswxnsrt@216.154.195.61>
References: <Xns95E8E243CF17Agjctcswxnsrt@216.154.195.61>
	<ct42do$q44$1@news.spamcop.net> <Xns95E9D1F415E7gjctcswxnsrt@216.154.195.61>
	<ct4ko6$9tk$1@news.spamcop.net> <Xns95E986003207gjctcswxnsrt@216.154.195.61>
	<ct5m13$vn4$1@news.spamcop.net> <Xns95E9B195E77B1gjctcswxnsrt@216.154.195.61>
	<Xns95E9BD8AF7780xnddmxn@216.154.195.61>
	<Xns95E9BBE4CABBFgjctcswxnsrt@216.154.195.61> <ct6b2h$hdm$1@news.spamcop.net>
	<Xns95E9E387CEACEgjctcswxnsrt@216.154.195.61> <ct6jbk$o9l$1@news.spamcop.net>
	<Xns95EA58EE64390gjctcswxnsrt@216.154.195.61> <ct7toi$mu3$1@news.spamcop.net>
	<Xns95EA806D55D95gjctcswxnsrt@216.154.195.61>
Message-ID: <ct9m2n$6at$1@news.spamcop.net>

Geoff Lane wrote:

> While I have no doubt that Spamcop is doing much good in the war against 
> spam, I seriously doubt that it is doing all it has a moral obligation to 
> do to avoid "collateral damage".

Just out of curiosity, every post by you has included the word "moral" 
coupled with a perceived lack of accountability on the part of Spamcop. 
But the core of the issue appears to be that your ISP didn't pass you 
the whole allegation, because if he had you would have had a clear 
escalation strategy:
  - talk to the complainant
  - when response is unacceptable, escalate to deputies

What am I missing? How could Spamcop be doing any better a job in your 
case _if your ISP had done his job_?
From ric.gates at bigsleep.org  Thu Jan 27 03:17:45 2005
From: ric.gates at bigsleep.org (Blammo)
Date: Wed Jan 26 22:20:03 2005
Subject: [SC-Help] Re: If you have been blocked by SpamCop, please read
References: <ct841k$r3e$1@news.spamcop.net>
	<s19srWK3yteU@eisner.encompasserve.org>
Message-ID: <Xns95EAC46935248blammo@216.154.195.61>

On 26 Jan 2005 John E. Malmberg entered spamcop.help and left 
news:s19srWK3yteU@eisner.encompasserve.org:

>       * Your PHP mailer program has been taken over by criminals.
>       ** You did not know that your PHP bulletin board had a very
>          vulnerable mailer program on it?
>       *** You did not know that you had PHP?
> 
> 

Not only PHP, but any server mailer script, if not written securely can 
allow spam to be relayed. I have discovered spiders that search for web 
forms with this vulnerability.

One example:
<http://www.google.com/search?q=%22imagx09%40aol.com%22>

-- 
| Ric
|
From driehuis.fcnzpbc2005 at playbeing.com  Thu Jan 27 04:34:26 2005
From: driehuis.fcnzpbc2005 at playbeing.com (Bert Driehuis)
Date: Wed Jan 26 22:35:03 2005
Subject: [SC-Help] Re: Wrongly accused
In-Reply-To: <ct6hh1$msq$1@news.spamcop.net>
References: <Xns95E8E243CF17Agjctcswxnsrt@216.154.195.61>
	<ct42do$q44$1@news.spamcop.net> <Xns95E9D1F415E7gjctcswxnsrt@216.154.195.61>
	<ct4ko6$9tk$1@news.spamcop.net> <Xns95E986003207gjctcswxnsrt@216.154.195.61>
	<ct6hh1$msq$1@news.spamcop.net>
Message-ID: <ct9nga$77s$1@news.spamcop.net>

Cat wrote:

> I've had spam a couple of times from PlusNet users before. I vaguely 
> remember that they seemed to be separate incidents, so I couldn't tell 
> how quickly the ISP took action. I can't judge from that alone the size 
> of their spam problem, but the CGI server issue and their trigger happy 
> attitude with claims that they don't have the resources to investigate 
> every complaint would suggest that they have a spam problem which they 
> aren't managing properly.

Actually, my personal experience with them (from the same position that 
you were -- complaining about spam relayed by PlusNet users) has been 
less negative. There are ISPs in the UK that are far worse.

The problem stems from them _trying_ to do the right thing but failing 
miserably at some attempts. That's a lot better than not even trying. 
But, this particular screwup will reward them with one really unhappy 
customer and some negative karma amongst abuse staff who follow 
spamcop.help. The  latter aspect is undesired and (I think) not entirely 
deserved (unless the alleged admission of not being able to properly run 
an abuse desk came from someone within PlusNet who knew what was going 
on; would you trust a staffer who mangles SpamCop reports to represent 
your company?)
From nobody at devnull.spamcop.net  Wed Jan 26 22:19:29 2005
From: nobody at devnull.spamcop.net (Cat)
Date: Wed Jan 26 23:20:03 2005
Subject: [SC-Help] Re: Wrongly accused
In-Reply-To: <ct9m2n$6at$1@news.spamcop.net>
References: <Xns95E8E243CF17Agjctcswxnsrt@216.154.195.61>
	<ct42do$q44$1@news.spamcop.net> <Xns95E9D1F415E7gjctcswxnsrt@216.154.195.61>
	<ct4ko6$9tk$1@news.spamcop.net> <Xns95E986003207gjctcswxnsrt@216.154.195.61>
	<ct5m13$vn4$1@news.spamcop.net> <Xns95E9B195E77B1gjctcswxnsrt@216.154.195.61>
	<Xns95E9BD8AF7780xnddmxn@216.154.195.61>
	<Xns95E9BBE4CABBFgjctcswxnsrt@216.154.195.61> <ct6b2h$hdm$1@news.spamcop.net>
	<Xns95E9E387CEACEgjctcswxnsrt@216.154.195.61> <ct6jbk$o9l$1@news.spamcop.net>
	<Xns95EA58EE64390gjctcswxnsrt@216.154.195.61> <ct7toi$mu3$1@news.spamcop.net>
	<Xns95EA806D55D95gjctcswxnsrt@216.154.195.61> <ct9m2n$6at$1@news.spamcop.net>
Message-ID: <ct9q4g$97q$1@news.spamcop.net>

Bert Driehuis wrote:

<snip>

> What am I missing? How could Spamcop be doing any better a job in your 
> case _if your ISP had done his job_?

That's also the issue that I have with Geoff's complaints against 
SpamCop. If PlusNet had done what they were supposed to do, which would 
be to properly investigate the complaint to determine that it was false 
instead of "shoot first, ask questions later," Geoff wouldn't be here 
complaining that SpamCop did anything wrong.
From nobody at devnull.spamcop.net  Wed Jan 26 22:25:31 2005
From: nobody at devnull.spamcop.net (Cat)
Date: Wed Jan 26 23:30:02 2005
Subject: [SC-Help] Re: Wrongly accused
In-Reply-To: <ct9ba2$spg$1@news.spamcop.net>
References: <Xns95E8E243CF17Agjctcswxnsrt@216.154.195.61>
	<ct42do$q44$1@news.spamcop.net> <Xns95E9D1F415E7gjctcswxnsrt@216.154.195.61>
	<ct4ko6$9tk$1@news.spamcop.net> <Xns95E986003207gjctcswxnsrt@216.154.195.61>
	<ct5m13$vn4$1@news.spamcop.net> <Xns95E9B195E77B1gjctcswxnsrt@216.154.195.61>
	<Xns95E9BD8AF7780xnddmxn@216.154.195.61>
	<Xns95E9BBE4CABBFgjctcswxnsrt@216.154.195.61> <ct6b2h$hdm$1@news.spamcop.net>
	<Xns95E9E387CEACEgjctcswxnsrt@216.154.195.61> <ct6jbk$o9l$1@news.spamcop.net>
	<Xns95EA58EE64390gjctcswxnsrt@216.154.195.61> <ct7toi$mu3$1@news.spamcop.net>
	<Xns95EA806D55D95gjctcswxnsrt@216.154.195.61> <ct84eo$rg9$1@news.spamcop.net>
	<Xns95EA8C4272D10gjctcswxnsrt@216.154.195.61> <ct8h6k$711$1@news.spamcop.net>
	<Xns95EACFFD0277Agjctcswxnsrt@216.154.195.61> <ct966q$oc2$1@news.spamcop.net>
	<ct9ba2$spg$1@news.spamcop.net>
Message-ID: <ct9qfq$9dd$1@news.spamcop.net>

Miss Betsy wrote:
> "Cat" <nobody@devnull.spamcop.net> wrote in message
> news:ct966q$oc2$1@news.spamcop.net...

<snip>

>>Well, since Miss Betsy and I both replied to you in this thread, not 
>>everyone who replied to attempt to help you understand this issue is a 
>>gentleman. Some of us are ladies.
> 
> 
> I am glad you pointed that out!  Since he didn't bother to respond
> to my first post, I didn't think he was reading my posts and
> decided just to post a rebuttal for the benefit of a newcomer who
> was reading the thread.

Yeah, I wondered why the "gentlemen" greeting was tossed in there since 
you and I both had replied to him. Always kind of makes me feel like 
some people either don't want to hear from a female or haven't 
considered that females might be reading or replying to them.
From nobody at devnull.spamcop.net  Wed Jan 26 23:13:50 2005
From: nobody at devnull.spamcop.net (Cat)
Date: Thu Jan 27 00:15:03 2005
Subject: [SC-Help] Re: Wrongly accused
In-Reply-To: <Xns95EB2FB25B5Fgjctcswxnsrt@216.154.195.61>
References: <Xns95E8E243CF17Agjctcswxnsrt@216.154.195.61>
	<ct42do$q44$1@news.spamcop.net> <Xns95E9D1F415E7gjctcswxnsrt@216.154.195.61>
	<ct4ko6$9tk$1@news.spamcop.net> <Xns95E986003207gjctcswxnsrt@216.154.195.61>
	<ct5m13$vn4$1@news.spamcop.net> <Xns95E9B195E77B1gjctcswxnsrt@216.154.195.61>
	<Xns95E9BD8AF7780xnddmxn@216.154.195.61>
	<Xns95E9BBE4CABBFgjctcswxnsrt@216.154.195.61> <ct6b2h$hdm$1@news.spamcop.net>
	<Xns95E9E387CEACEgjctcswxnsrt@216.154.195.61> <ct6jbk$o9l$1@news.spamcop.net>
	<Xns95EA58EE64390gjctcswxnsrt@216.154.195.61> <ct7toi$mu3$1@news.spamcop.net>
	<Xns95EA806D55D95gjctcswxnsrt@216.154.195.61> <ct84eo$rg9$1@news.spamcop.net>
	<Xns95EA8C4272D10gjctcswxnsrt@216.154.195.61> <ct8h6k$711$1@news.spamcop.net>
	<Xns95EACFFD0277Agjctcswxnsrt@216.154.195.61> <ct966q$oc2$1@news.spamcop.net>
	<Xns95EB2FB25B5Fgjctcswxnsrt@216.154.195.61>
Message-ID: <ct9tac$d3p$1@news.spamcop.net>

Geoff Lane wrote:
> Cat <nobody@devnull.spamcop.net> wrote in
> news:ct966q$oc2$1@news.spamcop.net: 
> 
> 
>>Well, since Miss Betsy and I both replied to you in this thread, not 
>>everyone who replied to attempt to help you understand this issue is a
>>gentleman. Some of us are ladies.
> 
> ---
> My apologies. However, although I now suspect it isn't politically
> correct where you are, where I live, "gentemen" means "gathering of
> esteemed colleagues" in the contex I used. Perhaps I've been watching
> too many films, but I've also heard that used in the same way in the
> portrayal of US military. 

Hehe, now you know better for next time. :-P

The "gathering of esteemed colleagues" bit enforces the outdated nature 
of such a greeting. One thing I've learned about any sort of 
correspondence, especially in business, is that sort of thing sends the 
message that you assume you're only dealing with men and aren't 
expecting a woman to be in a position to help you.

<snip>

> Now I'm not disputing the first in any way -- of course the ISP has a 
> duty of care. Certainly, the way that my ISP acted was reprehensible, and 
> I've taken them to task over that.

That's good that you complained to your ISP about how they handled the 
incident, and they should be more responsible about investigating 
complaints. SpamCop worked the way it was supposed to, which was to 
serve as a tool to determine the source. If your ISP had done what it 
was supposed to do, you wouldn't be here complaining that SpamCop did 
anything wrong.

> I also feel that Spamcop also has a moral duty to provide the means for 
> the convicted to know of what he is accused. That means he needs to be 
> able to access the reports being used in evidence against him. Right now, 
> if someone accuses me of spamming I cannot see what it is that I'm 
> supposed to have sent. The nature of the spam gives essential clues as to 
> the cause, be it that I'm personally spamming, I have malware running on 
> my computer, I have an open relay, or the reports are unwarranted. To 
> that end, I suggest making reports available to requests from an IP 
> address that features in the headers of the alleged spam. That would go a 
> long way towards helping those with fixed IP addresses to resolve t